IntenseFinance/firefly-iii
3
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2026-08-26 13:17:30 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix some headers, expand changelog.

Browse Source
This commit is contained in:
James Cole
2026-07-30 20:31:42 +02:00
parent bfae310cc5
commit 4a78f72d64
2 changed files with 44 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Middleware/SecureHeaders.php
+29 -39
View File
@@ -68,28 +68,28 @@ class SecureHeaders
"manifest-src 'self'",
];
// overrule in development mode
if (true === config('firefly.is_local_dev')) {
$ip = '192.168.96.165';
$csp = [
"default-src 'none'",
"object-src 'none'",
sprintf("script-src 'unsafe-eval' 'strict-dynamic' 'nonce-%1s'", $nonce),
// sprintf("style-src 'self' 'nonce-%1s' https://10.0.0.15:5173/", $nonce), // safe variant
sprintf("style-src 'self' 'unsafe-inline' https://%s:5173/", $ip), // unsafe variant
"base-uri 'self'",
"form-action 'self'",
sprintf("font-src 'self' data: https://%s:5173/", $ip),
sprintf('connect-src \'self\' %1$s https://%2$s:5173/ wss://%2$s:5173/', $trackingScriptSrc, $ip),
sprintf("img-src 'self' data: 'nonce-%1s'", $nonce),
"manifest-src 'self'",
];
}
// // overrule in development mode
// if (true === config('firefly.is_local_dev')) {
// $ip = '192.168.96.165';
// $csp = [
// "default-src 'none'",
// "object-src 'none'",
// sprintf("script-src 'unsafe-eval' 'strict-dynamic' 'nonce-%1s'", $nonce),
// // sprintf("style-src 'self' 'nonce-%1s' https://10.0.0.15:5173/", $nonce), // safe variant
// sprintf("style-src 'self' 'unsafe-inline' https://%s:5173/", $ip), // unsafe variant
// "base-uri 'self'",
// "form-action 'self'",
// sprintf("font-src 'self' data: https://%s:5173/", $ip),
// sprintf('connect-src \'self\' %1$s https://%2$s:5173/ wss://%2$s:5173/', $trackingScriptSrc, $ip),
// sprintf("img-src 'self' data: 'nonce-%1s'", $nonce),
// "manifest-src 'self'",
// ];
// }
$route = $request->route();
$customUrl = '';
$authGuard = (string) config('firefly.authentication_guard');
$logoutUrl = (string) config('firefly.custom_logout_url');
$authGuard = (string)config('firefly.authentication_guard');
$logoutUrl = (string)config('firefly.custom_logout_url');
if ('remote_user_guard' === $authGuard && '' !== $logoutUrl) {
$customUrl = $logoutUrl;
}
@@ -98,22 +98,6 @@ class SecureHeaders
$csp[] = sprintf("form-action 'self' %s", $customUrl);
}
$featurePolicies = [
"geolocation 'none'",
"midi 'none'",
// "notifications 'none'",
// "push 'self'",
"sync-xhr 'self'",
"microphone 'none'",
"camera 'none'",
"magnetometer 'none'",
"gyroscope 'none'",
// "speaker 'none'",
// "vibrate 'none'",
"fullscreen 'self'",
"payment 'none'",
];
$disableFrameHeader = config('firefly.disable_frame_header');
$disableCSP = config('firefly.disable_csp_header');
if (false === $disableFrameHeader) {
@@ -132,13 +116,17 @@ class SecureHeaders
$response->headers->set('Content-Security-Policy', implode('; ', $csp));
}
}
$permissionsPolicy = 'unload=(), geolocation=(), microphone=(), camera=(), payment=(), magnetometer=(), gyroscope=()';
if (method_exists($response, 'header')) {
$response->header('X-XSS-Protection', '1; mode=block');
$response->header('X-Content-Type-Options', 'nosniff');
$response->header('Referrer-Policy', 'no-referrer');
$response->header('X-Permitted-Cross-Domain-Policies', 'none');
$response->header('X-Robots-Tag', 'none');
$response->header('Feature-Policy', implode('; ', $featurePolicies));
$response->header('Permissions-Policy', $permissionsPolicy);
$response->header('Cross-Origin-Opener-Policy', 'same-origin');
$response->header('Cross-Origin-Resource-Policy', 'same-origin');
}
if (!method_exists($response, 'header')) {
$response->headers->set('X-XSS-Protection', '1; mode=block');
@@ -146,7 +134,9 @@ class SecureHeaders
$response->headers->set('Referrer-Policy', 'no-referrer');
$response->headers->set('X-Permitted-Cross-Domain-Policies', 'none');
$response->headers->set('X-Robots-Tag', 'none');
$response->headers->set('Feature-Policy', implode('; ', $featurePolicies));
$response->headers->set('Permissions-Policy', $permissionsPolicy);
$response->headers->set('Cross-Origin-Opener-Policy', 'same-origin');
$response->headers->set('Cross-Origin-Resource-Policy', 'same-origin');
}
return $response;
@@ -157,8 +147,8 @@ class SecureHeaders
*/
private function getTrackingScriptSource(): string
{
if ('' !== (string) config('firefly.tracker_site_id') && '' !== (string) config('firefly.tracker_url')) {
return (string) config('firefly.tracker_url');
if ('' !== (string)config('firefly.tracker_site_id') && '' !== (string)config('firefly.tracker_url')) {
return (string)config('firefly.tracker_url');
}
return '';
changelog.md
+9
View File
@@ -3,6 +3,15 @@
All notable changes to this project will be documented in this file.
This project adheres to [Semantic Versioning](http://semver.org/).
## v6.7.0
Security findings by Alwen Roselio, Don Werner Salas and Allan Glenn Aceres.
## v6.6.6 - 2026-07-01
<!-- summary: This release fixes a bug in v6.6.5 that will remove foreign currency information from deposits. -->