From 1cf0748a49fd7d924e020f26462b83ae628e1437 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Fri, 1 Jan 2021 13:51:28 -0800 Subject: [PATCH] apache2: Allow downloads in openvpn and backups with latest browsers Closes: #2002. Entire FreedomBox UI is served within a sandbox that is originally meant for cross-site iframes. A newly introduced flag allow-downloads is required to trigger downloads. Two instances where this is used in FreedomBox is openvpn profiled download and backup download. Firefox 81 and Chrome 83 implement this flag. Add 'allow-downloads' to sandbox directives to fix this. References: - https://github.com/whatwg/html/pull/4293 - https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe - https://bugzilla.mozilla.org/show_bug.cgi?id=1558394 - https://www.chromestatus.com/feature/5706745674465280 Tests: - Check that OpenVPN profile can be downloaded. - Check that backups can be downloaded. - Check on Firefox 78 and Chromium 83. Signed-off-by: Sunil Mohan Adapa Reviewed-by: Veiko Aasa --- data/etc/apache2/conf-available/freedombox.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/etc/apache2/conf-available/freedombox.conf b/data/etc/apache2/conf-available/freedombox.conf index 893eb32ff..255f1becf 100644 --- a/data/etc/apache2/conf-available/freedombox.conf +++ b/data/etc/apache2/conf-available/freedombox.conf @@ -46,7 +46,7 @@ RedirectMatch "^/freedombox" "/plinth" ## Header set Referrer-Policy 'same-origin' - Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-forms allow-same-origin; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" + Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-forms allow-same-origin allow-downloads; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" Header set X-Content-Type-Options 'nosniff'