composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-02-13 07:24:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/support/2.7' into develop

Browse Source 
# Conflicts:
#	application/itopwebpage.class.inc.php
#	core/config.class.inc.php
#	setup/setuputils.class.inc.php
This commit is contained in:
Molkobain
2021-08-18 18:55:56 +02:00
parent 909af7f59c 1c983e8093
commit 1613c1bbdc
4 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/config.class.inc.php
View File

@@ -1415,6 +1415,14 @@ class Config
'source_of_value' => '',
'show_in_conf_sample' => false,
],
'security.disable_inline_documents_sandbox' => [
'type' => 'bool',
'description' => 'If true then the sandbox for documents displayed in a browser tab will be disabled; enabling scripts and other interactive content. Note that setting this to true will open the application to potential XSS attacks!',
'default' => false,
'value' => false,
'source_of_value' => '',
'show_in_conf_sample' => false,
],
'behind_reverse_proxy' => [
'type' => 'bool',
'description' => 'If true, then proxies custom header (X-Forwarded-*) are taken into account. Use only if the webserver is not publicly accessible (reachable only by the reverse proxy)',

5
datamodels/2.x/itop-portal-base/portal/src/Controller/ObjectController.php
View File

@@ -1097,6 +1097,11 @@ class ObjectController extends BrickController
$aHeaders['Content-Type'] = $oDocument->GetMimeType();
$aHeaders['Content-Disposition'] = (($sOperation === 'display') ? 'inline' : 'attachment').';filename="'.$oDocument->GetFileName().'"';
// N°4129 - Prevent XSS attacks & other script executions
if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
$aHeaders['Content-Security-Policy'] = 'sandbox';
}
return new Response($oDocument->GetData(), Response::HTTP_OK, $aHeaders);
}

5
pages/ajax.render.php
View File

@@ -831,6 +831,11 @@ try
$iCacheSec = (int)utils::ReadParam('cache', 0);
$oPage->set_cache($iCacheSec);
// N°4129 - Prevent XSS attacks & other script executions
if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
$oPage->add_header('Content-Security-Policy: sandbox;');
}
ormDocument::DownloadDocument($oPage, $sClass, $id, $sField, 'inline');
$oKPI->ComputeAndReport('Data fetch and format');
}

20
setup/setuputils.class.inc.php
View File

@@ -103,7 +103,7 @@ class SetupUtils
// -- First recent version that is not yet validated by Combodo (warning)
const PHP_NOT_VALIDATED_VERSION = '8.0.0';
const MIN_MEMORY_LIMIT = 33554432; // 32 * 1024 * 1024 - we can use expressions in const since PHP 5.6 but we are in the setup !
const MIN_MEMORY_LIMIT = '32M';
const SUHOSIN_GET_MAX_VALUE_LENGTH = 2048;
/**
@@ -305,23 +305,19 @@ class SetupUtils
// Check some more ini settings here, needed for file upload
$sMemoryLimit = trim(ini_get('memory_limit'));
if (empty($sMemoryLimit))
{
if (empty($sMemoryLimit)) {
// On some PHP installations, memory_limit does not exist as a PHP setting!
// (encountered on a 5.2.0 under Windows)
// In that case, ini_set will not work, let's keep track of this and proceed anyway
$aResult[] = new CheckResult(CheckResult::WARNING, "No memory limit has been defined in this instance of PHP");
}
else
{
} else {
// Check that the limit will allow us to load the data
//
$iMemoryLimit = utils::ConvertToBytes($sMemoryLimit);
if (!utils::IsMemoryLimitOk($iMemoryLimit, self::MIN_MEMORY_LIMIT)) {
$aResult[] = new CheckResult(CheckResult::ERROR,
"memory_limit ($iMemoryLimit) is too small, the minimum value to run the application is ".self::MIN_MEMORY_LIMIT.".");
}
else {
$iCurrentMemoryLimit = utils::ConvertToBytes($sMemoryLimit);
$iMinMemoryLimit = utils::ConvertToBytes(self::MIN_MEMORY_LIMIT);
if (!utils::IsMemoryLimitOk($iCurrentMemoryLimit, $iMinMemoryLimit)) {
$aResult[] = new CheckResult(CheckResult::ERROR, "memory_limit ($sMemoryLimit) is too small, the minimum value to run the application is ".self::MIN_MEMORY_LIMIT.".");
} else {
$aResult[] = new CheckResult(CheckResult::TRACE, "Info - memory_limit is $iMemoryLimit, ok.");
}
}