From d21ec61f065e7994d46743269e9907c0da8a56dc Mon Sep 17 00:00:00 2001 From: Ajurna Date: Fri, 30 Apr 2021 19:37:56 +0100 Subject: [PATCH] adding csp --- cbreader/settings/base.py | 10 +++-- comic/models.py | 2 +- comic/templates/base.html | 8 ++-- comic/templates/comic/comic_list.html | 27 +++++++------ comic/util.py | 9 ++++- static/css/base.css | 54 ++++++-------------------- static/css/base.min.css | 1 + static/img/ccbysa.png | Bin 0 -> 1515 bytes static/js/comic_list.js | 25 ++++++++++-- static/js/comic_list.min.js | 2 +- 10 files changed, 71 insertions(+), 67 deletions(-) create mode 100644 static/css/base.min.css create mode 100644 static/img/ccbysa.png diff --git a/cbreader/settings/base.py b/cbreader/settings/base.py index 5f7b36e..168c4e3 100644 --- a/cbreader/settings/base.py +++ b/cbreader/settings/base.py @@ -146,6 +146,10 @@ BOOTSTRAP4 = { "crossorigin": "anonymous", }, } -CSP_DEFAULT_SRC = ("'self'", "'unsafe-inline'", 'cdn.jsdelivr.net', 'cdn.datatables.net', 'i.creativecommons.org', - 'code.jquery.com', 'licensebuttons.net', 'www.w3.org') -CSP_IMG_SRC = ("'self'", 'i.creativecommons.org', 'licensebuttons.net') \ No newline at end of file +CSP_DEFAULT_SRC = ("'none'") +CSP_STYLE_SRC = ("'self'", 'cdn.jsdelivr.net', 'cdn.datatables.net') +CSP_IMG_SRC = ("'self'", "data:") +CSP_FONT_SRC = ("'self'") +CSP_SCRIPT_SRC = ("'self'", 'code.jquery.com', 'cdn.jsdelivr.net', 'cdn.datatables.net') +CSP_CONNECT_SRC = ("'self'") +CSP_INCLUDE_NONCE_IN = ['script-src'] \ No newline at end of file diff --git a/comic/models.py b/comic/models.py index e71dff5..ec86c5c 100644 --- a/comic/models.py +++ b/comic/models.py @@ -12,7 +12,7 @@ import fitz import rarfile from PIL import Image, UnidentifiedImageError from django.conf import settings -from django.contrib.auth.models import User +from django.contrib.auth.models import User, AbstractUser from django.core.files.uploadedfile import InMemoryUploadedFile from django.db import models from django.db.transaction import atomic diff --git a/comic/templates/base.html b/comic/templates/base.html index d34c512..1163cdd 100644 --- a/comic/templates/base.html +++ b/comic/templates/base.html @@ -11,13 +11,13 @@ - {% block title %}CB Reader{% endblock %} + {% block title %}CB Web Reader{% endblock %} {% bootstrap_css %} - + {# #} @@ -28,7 +28,7 @@