Author: ralfbecker
New Revision: 47724
URL: http://svn.stylite.de/viewvc/egroupware?rev=47724&view=rev
Log:
mitigate risk of serving javascript or css via webdav from our domain
Modified:
branches/1.8/phpgwapi/inc/class.vfs_webdav_server.inc.php
Modified: branches/1.8/phpgwapi/inc/class.vfs_webdav_server.inc.php
URL: http://svn.stylite.de/viewvc/egroupware/branches/1.8/phpgwapi/inc/class.vfs_webdav_server.inc.php?rev=47724&r1=47723&r2=47724&view=diff
— branches/1.8/phpgwapi/inc/class.vfs_webdav_server.inc.php (original)
+++ branches/1.8/phpgwapi/inc/class.vfs_webdav_server.inc.php Wed Jul 16 16:54:56 2014
@@ -666,6 +666,29 @@
{
if (($ok = parent::GET($options)))
{
-
// mitigate risk of serving javascript or css via webdav from our domain, -
// which will get around same origin policy and CSP -
list($type, $subtype) = explode('/', strtolower($options['mimetype'])); -
if (!$this->force_download && in_array($type, array('application', 'text')) && -
in_array($subtype, array('javascript', 'x-javascript', 'ecmascript', 'jscript', 'vbscript', 'css'))) -
{ -
// unfortunatly only Chrome and IE >= 8 allow to switch content-sniffing off with X-Content-Type-Options: nosniff -
if (html::$user_agent == 'chrome' || html::$user_agent == 'msie' && html::$ua_version >= 8) -
{ -
$options['mimetype'] = 'text/plain'; -
header('X-Content-Type-Options: nosniff'); // stop IE & Chrome from content-type sniffing -
} -
// for the rest we change mime-type to text/html and let code below handle it safely -
// this stops Safari and Firefox from using it as src attribute in a script tag -
else -
{ -
$options['mimetype'] = 'text/html'; -
$options['data'] = '<pre>'.fread($options['stream'], $options['length']); -
fclose($options['stream']); -
unset($options['stream']); -
$options['size'] += 4; -
} -
} // mitigate risk of html downloads by using CSP or force download for IE if (!$this->force_download && in_array($options['mimetype'], array('text/html', 'application/xhtml+xml'))) {
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world’s largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
eGroupWare-cvs mailing list
eGroupWare-cvs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-cvs