IntenseFinance/firefly-iii
3
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2025-02-20 11:48:27 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fixes #2338

Browse Source
This commit is contained in:
James Cole 2019-07-16 19:21:58 +02:00
parent a70b7cc7b9
commit 531161db09
No known key found for this signature in database
GPG Key ID: C16961E655E74B5E
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
app/Http/Controllers/AttachmentController.php
View File

@ -78,7 +78,7 @@ class AttachmentController extends Controller
/**
* Destroy attachment.
*
* @param Request $request
* @param Request $request
* @param Attachment $attachment
*
* @return \Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector
@ -131,7 +131,7 @@ class AttachmentController extends Controller
/**
* Edit an attachment.
*
* @param Request $request
* @param Request $request
* @param Attachment $attachment
*
* @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View
@ -178,7 +178,7 @@ class AttachmentController extends Controller
* Update attachment.
*
* @param AttachmentFormRequest $request
* @param Attachment $attachment
* @param Attachment $attachment
*
* @return RedirectResponse
*/
@ -211,13 +211,27 @@ class AttachmentController extends Controller
* @return LaravelResponse
* @throws FireflyException
*/
public function view(Attachment $attachment): LaravelResponse
public function view(Request $request, Attachment $attachment): LaravelResponse
{
if ($this->repository->exists($attachment)) {
$content = $this->repository->getContent($attachment);
// prevent XSS by adding a new secure header.
$csp = [
"default-src 'none'",
"object-src 'none'",
"script-src 'none'",
"style-src 'none'",
"base-uri 'none'",
"font-src 'none'",
"connect-src 'none'",
"img-src 'none'",
"manifest-src 'none'",
];
return response()->make(
$content, 200, [
'Content-Security-Policy' => implode('; ', $csp),
'Content-Type' => $attachment->mime,
'Content-Disposition' => 'inline; filename="' . $attachment->filename . '"',
]

8
app/Http/Middleware/SecureHeaders.php
View File

@ -36,7 +36,7 @@ class SecureHeaders
* Handle an incoming request. May not be a limited user (ie. Sandstorm env. or demo user).
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @param \Closure $next
*
* @return mixed
*/
@ -85,7 +85,11 @@ class SecureHeaders
if (false === $disableFrameHeader || null === $disableFrameHeader) {
$response->header('X-Frame-Options', 'deny');
}
$response->header('Content-Security-Policy', implode('; ', $csp));
// content security policy may be set elsewhere.
if (!$response->headers->has('Content-Security-Policy')) {
$response->header('Content-Security-Policy', implode('; ', $csp));
}
$response->header('X-XSS-Protection', '1; mode=block');
$response->header('X-Content-Type-Options', 'nosniff');
$response->header('Referrer-Policy', 'no-referrer');