Repository navigation
Expand file tree
/
Copy pathpolicy.js
More file actions
68 lines (63 loc) · 2.84 KB
/
policy.js
File metadata and controls
68 lines (63 loc) · 2.84 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
//import { BrowserPolicy } from 'meteor/browser-policy-common';
import { WebApp } from 'meteor/webapp';
const { framingHeaders, framingHeadersToDropOnNotModified } = require('/models/lib/framePolicy');
// FrameBleed (restored 2026-10-02): the framing restriction below was all
// commented out when browser-policy was removed in 2022, so WeKan's pages
// could be framed by any site. It is set here, as a raw header, for every
// response; a route that sets its own Content-Security-Policy (file
// responses) replaces it with a stricter one.
const FRAMING_HEADERS = framingHeaders({
enabled: process.env.BROWSER_POLICY_ENABLED === 'true',
trustedUrl: process.env.TRUSTED_URL,
sandstorm: !!(Meteor.settings && Meteor.settings.public && Meteor.settings.public.sandstorm),
});
if (Object.keys(FRAMING_HEADERS).length) {
WebApp.rawHandlers.use((req, res, next) => {
for (const [name, value] of Object.entries(FRAMING_HEADERS)) res.setHeader(name, value);
// ...except on a 304 Not Modified: the browser would put this CSP in
// place of the stored file's own (models/lib/framePolicy.js). Node sends
// every response's head through writeHead, an implicit one included.
const writeHead = res.writeHead;
res.writeHead = function writeHeadKeepingStoredPolicy(statusCode, ...rest) {
if (Number(statusCode) === 304) {
for (const name of framingHeadersToDropOnNotModified(FRAMING_HEADERS, n => res.getHeader(n))) res.removeHeader(name);
}
return writeHead.call(this, statusCode, ...rest);
};
next();
});
}
Meteor.startup(() => {
/*
// Default allowed
BrowserPolicy.content.allowInlineScripts();
BrowserPolicy.content.allowEval();
BrowserPolicy.content.allowInlineStyles();
BrowserPolicy.content.allowOriginForAll('*');
// Allow all images from anywhere
BrowserPolicy.content.allowImageOrigin('*');
BrowserPolicy.content.allowDataUrlForAll();
*/
if (process.env.BROWSER_POLICY_ENABLED === 'true') {
// Trusted URL that can embed Wekan in iFrame.
const trusted = process.env.TRUSTED_URL;
////BrowserPolicy.framing.disallow();
//Allow inline scripts, otherwise there is errors in browser/inspect/console
//BrowserPolicy.content.disallowInlineScripts();
//BrowserPolicy.content.disallowEval();
//BrowserPolicy.content.allowInlineStyles();
//BrowserPolicy.content.allowFontDataUrl();
////BrowserPolicy.framing.restrictToOrigin(trusted);
//BrowserPolicy.content.allowScriptOrigin(trusted);
} else {
// Disable browser policy and allow all framing and including.
// Use only at internal LAN, not at Internet.
////BrowserPolicy.framing.allowAll();
}
// If Matomo URL is set, allow it.
const matomoUrl = process.env.MATOMO_ADDRESS;
if (matomoUrl) {
//BrowserPolicy.content.allowScriptOrigin(matomoUrl);
//BrowserPolicy.content.allowImageOrigin(matomoUrl);
}
});