webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-19 22:03:19 +03:00
Code Activity
5,082 Commits 13 Branches 212 Tags
d13abc7e1d9c204640fe9a6624a162a7cc106de6
Commit Graph

13 Commits

Author SHA1 Message Date
Dan Brown
d13abc7e1d Mail: Removed custom symfony/mailer fork 
Moved to standard symfony mailer now that my patches have been
upstreamed. This changes the config to work with the symfony option,
following the same overall logic.
Also updated testing to allow test runs via mulitple custom env options.

Closes #5636
 2025-07-15 15:24:31 +01:00
Dan Brown
897bb338f9 CSP: Updated handling of drawio URL to consider port 
Previously if a custom port was used in the DRAWIO option it would not
be considered in the CSP handling, which would block loading.

Added test to cover.
For #5107
 2024-07-14 16:06:18 +01:00
Dan Brown
7c4dc981cd Middlware: Prevented caching of all app requests 
Previously we'd prevent caching of authed responses for security
(prevent back cache or proxy caching) but caching could still be an
issue in non-auth scenarios due to CSRF (eg. returning to login screen after
session expiry).

For #4600
 2023-10-23 13:32:15 +01:00
Dan Brown
72c8b138e1 Updated tests to use ssddanbrown/asserthtml package 
Closes #3519
 2022-07-23 15:10:18 +01:00
Dan Brown
ee6a2339b6 Applied latest styleCI changes 2022-03-09 14:30:36 +00:00
Dan Brown
856fca8289 Updated CSP with frame-src rules 
- Configurable via 'ALLOWED_IFRAME_SOURCES' .env option.
- Also updated how CSP rules are set, with a single header being used
  instead of many.
- Also applied CSP rules to HTML export outputs.
- Updated tests to cover.

For #3314
 2022-03-07 14:27:41 +00:00
Dan Brown
f77236aa38 Laravel 7.x Shift (#3011) 
* Apply Laravel coding style
* Shift bindings
* Shift core files
* Shift to Throwable
* Add laravel/ui dependency
* Shift Eloquent methods
* Shift config files
* Shift Laravel dependencies
* Shift cleanup
* Shift test config and references
* Applied styleci changes
* Applied fixes post shift to laravel 7

Co-authored-by: Shift <shift@laravelshift.com>
 2021-10-26 22:04:18 +01:00
Dan Brown
41ac69adb1 Forced response cache revalidation on logged-in responses 
- Prevents authenticated responses being visible when back button
  pressed in browser.
- Previously, 'no-cache, private' was added by default by Symfony which
  would have prevents proxy cache issues but this adds no-store and a
  max-age option to also invalidate all caching.

Thanks to @haxatron via huntr.dev
Ref: https://huntr.dev/bounties/6cda9df9-4987-4e1c-b48f-855b6901ef53/
 2021-10-08 15:22:09 +01:00
Dan Brown
fb80bb5d58 Applied latest styleci changes 2021-09-06 22:19:06 +01:00
Dan Brown
492af79c27 Added a couple of additional CSP rules 
As per guidance from google's CSP evaluator.
 2021-09-04 14:34:43 +01:00
Dan Brown
253f386f00 Finished off script CSP rules 
- Added caching for custom html head parsing to add nonce.
- Also moved api docs page into web routes to prevent issues.
 2021-09-04 13:57:04 +01:00
Dan Brown
934a833818 Apply fixes from StyleCI 2021-06-26 15:23:15 +00:00
Dan Brown
92922288dd Added iframe CSP, improved session cookie security 
Added iframe CSP headers with configuration via .env.
Updated session cookies to be lax by default, dynamically changing to
none when iframes configured to allow third-party control.
Updated cookie security to be auto-secure if a https APP_URL is set.

Related to #2427 and #2207.
 2021-01-02 02:43:50 +00:00