The_Great_Archive/cryptpad
1
0
Fork 0
mirror of https://github.com/cryptpad/cryptpad.git synced 2026-09-12 19:49:59 +05:00
Code Issues Packages Projects Releases Wiki Activity

Only allow loading onlyoffice fonts + update nginx #1472

Browse Source
This commit is contained in:
yflory 2024-04-17 15:12:27 +02:00
parent a3f80b60b0
commit 0604b708dc
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/example-advanced.nginx.conf
View File

@ -82,6 +82,9 @@ server {
# replace with the IP address of your resolver
resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220;
# OnlyOffice fonts may be loaded from both domains
if ($uri ~ ^\/common\/onlyoffice\/.*\/fonts\/.*$) { set $allowed_origins "*"; }
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header Access-Control-Allow-Origin "${allowed_origins}";

8
lib/http-worker.js
View File

@ -162,12 +162,10 @@ var setHeaders = function (req, res) {
var h = getHeaders(Env, type);
// XXX Allow main domain to load resources from the sandbox URL
// We can restrict this to onlyoffice fonts if we find a security issue with this
if (!Env.enableEmbedding && req.get('origin') === Env.httpUnsafeOrigin) {
//if (/^\/common\/onlyoffice\/dist\/.*\/fonts\/.*/.test(req.url)) {
// Allow main domain to load resources from the sandbox URL
if (!Env.enableEmbedding && req.get('origin') === Env.httpUnsafeOrigin &&
/^\/common\/onlyoffice\/dist\/.*\/fonts\/.*/.test(req.url)) {
h['Access-Control-Allow-Origin'] = Env.httpUnsafeOrigin;
//}
}
applyHeaderMap(res, h);