webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-01-03 23:42:28 +03:00
Code Activity

CSP: Updated handling of drawio URL to consider port

Browse Source 
Previously if a custom port was used in the DRAWIO option it would not
be considered in the CSP handling, which would block loading.

Added test to cover.
For #5107
This commit is contained in:
Dan Brown
2024-07-14 16:06:18 +01:00
parent 767699a066
commit 897bb338f9
2 changed files with 33 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
app/Util/CspService.php
View File

@@ -133,18 +133,30 @@ class CspService
protected function getAllowedIframeSources(): array
{
$sources = config('app.iframe_sources', '');
$hosts = array_filter(explode(' ', $sources));
$sources = explode(' ', config('app.iframe_sources', ''));
$sources[] = $this->getDrawioHost();
// Extract drawing service url to allow embedding if active
return array_filter($sources);
}
/**
* Extract the host name of the configured drawio URL for use in CSP.
* Returns empty string if not in use.
*/
protected function getDrawioHost(): string
{
$drawioConfigValue = config('services.drawio');
if ($drawioConfigValue) {
$drawioSource = is_string($drawioConfigValue) ? $drawioConfigValue : 'https://embed.diagrams.net/';
$drawioSourceParsed = parse_url($drawioSource);
$drawioHost = $drawioSourceParsed['scheme'] . '://' . $drawioSourceParsed['host'];
$hosts[] = $drawioHost;
if (!$drawioConfigValue) {
return '';
}
return $hosts;
$drawioSource = is_string($drawioConfigValue) ? $drawioConfigValue : 'https://embed.diagrams.net/';
$drawioSourceParsed = parse_url($drawioSource);
$drawioHost = $drawioSourceParsed['scheme'] . '://' . $drawioSourceParsed['host'];
if (isset($drawioSourceParsed['port'])) {
$drawioHost .= ':' . $drawioSourceParsed['port'];
}
return $drawioHost;
}
}