12 Commits

Author SHA1 Message Date
Sunil Mohan Adapa
1cf0748a49
apache2: Allow downloads in openvpn and backups with latest browsers
Closes: #2002.

Entire FreedomBox UI is served within a sandbox that is originally meant for
cross-site iframes.

A newly introduced flag allow-downloads is required to trigger downloads. Two
instances where this is used in FreedomBox is openvpn profiled download and
backup download. Firefox 81 and Chrome 83 implement this flag.

Add 'allow-downloads' to sandbox directives to fix this.

References:

- https://github.com/whatwg/html/pull/4293
- https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe
- https://bugzilla.mozilla.org/show_bug.cgi?id=1558394
- https://www.chromestatus.com/feature/5706745674465280

Tests:

- Check that OpenVPN profile can be downloaded.
- Check that backups can be downloaded.
- Check on Firefox 78 and Chromium 83.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2021-01-02 13:52:59 +02:00
Sunil Mohan Adapa
6574ec2d44
apache2: Disallow all inline styling in sandbox settings
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2020-12-19 16:26:54 +02:00
Sunil Mohan Adapa
8ab551f285
apache: Relax CSP to allow web workers for JSXC
Closes: #1893.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2020-06-29 23:31:03 +03:00
Sunil Mohan Adapa
110ec7d744
apache: Set CSP and other common security headers
Tests performed:

- Fonts Lato is properly and displayed.

- No <frame>, <iframe>, <video>, <audio>, <track>, <embed>, <object>, <applet>
tags are used in FreedomBox source code.

- Checked that there are no images referring to external URLs. Most of the
common images such as apps lists, system list, networks and manual show images
properly.

- Styles specified in main.css work as well as page specific styles such as in
networks. Firefox developer console shows inline styles loaded.

- JSXC is able to make XHR requests to ejabberd.

- Able to launch <a> links with _target='blank' such as in /help/support/.

- When visiting external websites, such as in donate page, Referer header is not
sent. When visiting page within FreedomBox interface, Referer header is sent
with path.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2020-06-29 10:09:36 +03:00
Sunil Mohan Adapa
c35938e180
apache: Serve SVG files compressed using gzip
- SVG is not one of the formats for which compress is turned on automatically by
  Apache configuration.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-05-16 06:42:01 -04:00
Joseph Nuthalapati
530423d490
config: Revert changes in freedombox.conf to avoid conffile prompt
The changes made to freedombox.conf in moving the apache homepage configuration
to an external file freedombox-apache-homepage.conf will cause a conffile prompt
when upgrading to freedombox 19.2. Reverting changes in freedombox.conf to avoid
this.

Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2019-03-01 13:22:32 -08:00
Joseph Nuthalapati
bd43ed515e
config: Remove Apache home page configuration from freedombox.conf
Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-02-23 10:31:05 -05:00
Joseph Nuthalapati
8bc34f84c3
config: Rename Default App to Webserver Home Page
Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2019-02-23 10:30:59 -05:00
Sunil Mohan Adapa
dfd46281c5
Serve default favicon for apps that don't provide one
Based on: https://salsa.debian.org/freedombox-team/plinth/merge_requests/1306

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
2019-01-26 20:23:16 -08:00
Joseph Nuthalapati
a309b28035
configuration: Use augeas to edit Apache files
Move the file editing code to actions/config since it must be executed by a
super user.

Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2018-07-29 20:50:14 -04:00
Joseph Nuthalapati
9a3af288fa
configuration: Option to set a default app for FreedomBox
Closes #1315

Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2018-07-29 20:50:10 -04:00
Sunil Mohan Adapa
7b75e97e96
apache: Move freedombox.conf configuration to Plinth
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Signed-off-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2017-10-04 19:26:42 -04:00