10 Commits

Author SHA1 Message Date
Sunil Mohan Adapa
8ab551f285
apache: Relax CSP to allow web workers for JSXC
Closes: #1893.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2020-06-29 23:31:03 +03:00
Sunil Mohan Adapa
110ec7d744
apache: Set CSP and other common security headers
Tests performed:

- Fonts Lato is properly and displayed.

- No <frame>, <iframe>, <video>, <audio>, <track>, <embed>, <object>, <applet>
tags are used in FreedomBox source code.

- Checked that there are no images referring to external URLs. Most of the
common images such as apps lists, system list, networks and manual show images
properly.

- Styles specified in main.css work as well as page specific styles such as in
networks. Firefox developer console shows inline styles loaded.

- JSXC is able to make XHR requests to ejabberd.

- Able to launch <a> links with _target='blank' such as in /help/support/.

- When visiting external websites, such as in donate page, Referer header is not
sent. When visiting page within FreedomBox interface, Referer header is sent
with path.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2020-06-29 10:09:36 +03:00
Sunil Mohan Adapa
c35938e180
apache: Serve SVG files compressed using gzip
- SVG is not one of the formats for which compress is turned on automatically by
  Apache configuration.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-05-16 06:42:01 -04:00
Joseph Nuthalapati
530423d490
config: Revert changes in freedombox.conf to avoid conffile prompt
The changes made to freedombox.conf in moving the apache homepage configuration
to an external file freedombox-apache-homepage.conf will cause a conffile prompt
when upgrading to freedombox 19.2. Reverting changes in freedombox.conf to avoid
this.

Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2019-03-01 13:22:32 -08:00
Joseph Nuthalapati
bd43ed515e
config: Remove Apache home page configuration from freedombox.conf
Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-02-23 10:31:05 -05:00
Joseph Nuthalapati
8bc34f84c3
config: Rename Default App to Webserver Home Page
Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-02-23 10:30:59 -05:00
Sunil Mohan Adapa
dfd46281c5
Serve default favicon for apps that don't provide one
Based on: https://salsa.debian.org/freedombox-team/plinth/merge_requests/1306

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
2019-01-26 20:23:16 -08:00
Joseph Nuthalapati
a309b28035
configuration: Use augeas to edit Apache files
Move the file editing code to actions/config since it must be executed by a
super user.

Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2018-07-29 20:50:14 -04:00
Joseph Nuthalapati
9a3af288fa
configuration: Option to set a default app for FreedomBox
Closes #1315

Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2018-07-29 20:50:10 -04:00
Sunil Mohan Adapa
7b75e97e96
apache: Move freedombox.conf configuration to Plinth
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2017-10-04 19:26:42 -04:00