Skip to content

Commit 5a3272b

Browse files
elcreatorelcreator
committed
Added CSP via nonce and removed jQuery dependency in the web installer
1 parent 004814e commit 5a3272b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+254
-169
lines changed

‎install/.htaccess‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<IfModule mod_headers.c>
2+
Header always unset Content-Security-Policy
3+
</IfModule>

‎install/cli-install.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,7 @@ public function checkConnectToDatabaseWithBase()
332332
try {
333333
$this->dbh->query('CREATE DATABASE "' . $this->database . '" ENCODING \'' . $this->database_charset . '\';');
334334
if ($this->dbh->errorCode() > 0) {
335-
echo '<span id="database_fail" style="color:#FF0000;">' . print_r($this->dbh->errorInfo(), true) . '</span>';
335+
echo '<span id="database_fail">' . print_r($this->dbh->errorInfo(), true) . '</span>';
336336
}
337337
$error = -1;
338338
} catch (Exception $exception) {

‎install/index.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@
2828
require_once 'src/lang.php';
2929
require_once 'src/functions.php';
3030

31+
$nonce = csrfNonce();
32+
header("content-security-policy: default-src 'self' 'nonce-$nonce';"
33+
. " script-src 'self' 'nonce-$nonce'; style-src 'self' 'nonce-$nonce';"
34+
. " frame-ancestors 'none';");
35+
3136
if (empty($_GET['s'])) {
3237
require_once '../' . MGR_DIR . '/includes/version.inc.php';
3338

‎install/src/controllers/connection.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,9 @@
6868
$ph['tableprefix'] = isset($_POST['tableprefix']) ? strip_tags($_POST['tableprefix']) : $table_prefix;
6969
$ph['selected_set_character_set'] = isset($database_connection_method) && $database_connection_method === 'SET CHARACTER SET' ? 'selected' : '';
7070
$ph['selected_set_names'] = isset($database_connection_method) && $database_connection_method === 'SET NAMES' ? 'selected' : '';
71-
$ph['show#connection_method'] = (($installMode == 0) || ($installMode == 2)) ? 'block' : 'none';
71+
$ph['show#connection_method'] = (($installMode == 0) || ($installMode == 2)) ? '' : 'hidden';
7272
$ph['database_collation'] = isset($_POST['database_collation']) ? $_POST['database_collation'] : $database_collation;
73-
$ph['show#AUH'] = ($installMode == 0) ? 'block' : 'none';
73+
$ph['show#AUH'] = ($installMode == 0) ? '' : 'hidden';
7474
$ph['cmsadmin'] = isset($_POST['cmsadmin']) ? strip_tags($_POST['cmsadmin']) : 'admin';
7575
$ph['cmsadminemail'] = isset($_POST['cmsadminemail']) ? strip_tags($_POST['cmsadminemail']) : '';
7676
$ph['cmspassword'] = isset($_POST['cmspassword']) ? strip_tags($_POST['cmspassword']) : '';

‎install/src/controllers/connection/collation.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
echo $output;
5656
exit();
5757
} catch (Exception $e) {
58-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
58+
echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
5959
exit();
6060
}
6161
echo $output;

‎install/src/controllers/connection/databasetest.php‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,17 @@
2525
if ($result->errorCode() == 0) {
2626
$data = $result->fetch();
2727
if ($data['setting'] != $database_charset) {
28-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . sprintf($_lang['status_failed_database_collation_does_not_match'], $data['setting']) . '</span>';
28+
echo $output . '<span id="database_fail">' . sprintf($_lang['status_failed_database_collation_does_not_match'], $data['setting']) . '</span>';
2929
exit();
3030
}
3131
$result = $dbh->query("SELECT COUNT(*) FROM {$tableprefix}site_content");
3232

3333
if ($dbh->errorCode() == 0) {
34-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed_table_prefix_already_in_use'] . '</span>';
34+
echo $output . '<span id="database_fail">' . $_lang['status_failed_table_prefix_already_in_use'] . '</span>';
3535
exit();
3636
}
3737
} else {
38-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . print_r($result->errorInfo(), true) . '</span>';
38+
echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . print_r($result->errorInfo(), true) . '</span>';
3939
exit();
4040
}
4141
break;
@@ -44,14 +44,14 @@
4444
if ($result->errorCode() == 0) {
4545
$data = $result->fetch();
4646
if ($data['Value'] != $database_collation) {
47-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . sprintf($_lang['status_failed_database_collation_does_not_match'], $data['1']) . '</span>';
47+
echo $output . '<span id="database_fail">' . sprintf($_lang['status_failed_database_collation_does_not_match'], $data['1']) . '</span>';
4848
exit();
4949
}
5050

5151
$result = $dbh->query("SELECT COUNT(*) FROM {$tableprefix}site_content");
5252

5353
if ($dbh->errorCode() == 0) {
54-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed_table_prefix_already_in_use'] . '</span>';
54+
echo $output . '<span id="database_fail">' . $_lang['status_failed_table_prefix_already_in_use'] . '</span>';
5555
exit();
5656
}
5757
$result = $dbh->query("SELECT SCHEMA_NAME
@@ -60,20 +60,20 @@
6060
if ($dbh->errorCode() == 0) {
6161
$data = $result->fetch();
6262
if (isset($data['SCHEMA_NAME']) && $data['SCHEMA_NAME'] == $pwd) {
63-
echo $output . '<span id="database_pass" style="color:#80c000;"> ' . $_lang['status_passed'] . '</span>';
63+
echo $output . '<span id="database_pass"> ' . $_lang['status_passed'] . '</span>';
6464
exit();
6565
}
6666
}
6767
} else {
68-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . print_r($result->errorInfo(), true) . '</span>';
68+
echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . print_r($result->errorInfo(), true) . '</span>';
6969
exit();
7070
}
7171
break;
7272
}
7373

7474
} catch (PDOException $e) {
7575
if (!stristr($e->getMessage(), 'database "' . $pwd . '" does not exist') && !stristr($e->getMessage(), 'Unknown database \'' . $database_name . '\'') && !stristr($e->getMessage(), 'Base table or view not found')) {
76-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
76+
echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
7777
exit();
7878
}
7979
}
@@ -86,7 +86,7 @@
8686
$dbh->query('CREATE DATABASE "' . $database_name . '" ENCODING \'' . $database_charset . '\';');
8787
if ($dbh->errorCode() > 0) {
8888
if (stristr($dbh->errorInfo()[2], 'already exists') === false) {
89-
$output .= '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed_could_not_create_database'] . ' ' . print_r($dbh->errorInfo(), true) . '</span>';
89+
$output .= '<span id="database_fail">' . $_lang['status_failed_could_not_create_database'] . ' ' . print_r($dbh->errorInfo(), true) . '</span>';
9090
}
9191
}
9292
} catch (Exception $exception) {
@@ -97,21 +97,21 @@
9797
case 'mysql':
9898
$query = 'CREATE DATABASE IF NOT EXISTS `' . $database_name . '` CHARACTER SET ' . $database_charset . ' COLLATE ' . $database_collation . ";";
9999
if (!$dbh->query($query)) {
100-
$output .= '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed_could_not_create_database'] . '</span>';
100+
$output .= '<span id="database_fail">' . $_lang['status_failed_could_not_create_database'] . '</span>';
101101
echo $output;
102102
exit();
103103
} else {
104-
$output .= '<span id="database_pass" style="color:#80c000;">' . $_lang['status_passed_database_created'] . '</span>';
104+
$output .= '<span id="database_pass">' . $_lang['status_passed_database_created'] . '</span>';
105105
echo $output;
106106
exit();
107107
}
108108
break;
109109
}
110110

111-
echo $output . '<span id="database_pass" style="color:#80c000;"> ' . $_lang['status_passed'] . '</span>';
111+
echo $output . '<span id="database_pass"> ' . $_lang['status_passed'] . '</span>';
112112
exit();
113113
} catch (PDOException $e) {
114-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
114+
echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
115115
}
116116

117117
echo $output;

‎install/src/controllers/connection/servertest.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
$output = $_lang['status_connecting'];
88
try {
99
$dbh = new PDO($method . ':host=' . $host . ';', $uid, $pwd);
10-
$output .= '<span id="server_pass" style="color:#80c000;"> ' . $_lang['status_passed_server'] . '</span>';
10+
$output .= '<span id="server_pass"> ' . $_lang['status_passed_server'] . '</span>';
1111
} catch (PDOException $e) {
12-
$output .= '<span id="server_fail" style="color:#FF0000;"> ' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
12+
$output .= '<span id="server_fail"> ' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
1313
}
1414
echo $output;

‎install/src/controllers/install.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -764,7 +764,7 @@
764764

765765
} catch (PDOException $e) {
766766
if (!stristr($e->getMessage(), 'database "' . $_POST['database_name'] . '" does not exist') && !stristr($e->getMessage(), 'Unknown database \'' . $_POST['database_name'] . '\'')) {
767-
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
767+
echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
768768
exit();
769769
}
770770
}

‎install/src/controllers/language.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?php
22
$content = file_get_contents(dirname(__DIR__) . '/template/actions/language.tpl');
3-
$content = parse($content, ['langOptions' => getLangOptions($install_language)]);
3+
$content = parse($content, array_merge(ph(), ['langOptions' => getLangOptions($install_language)]));
44
$content = parse($content, $_lang,'[%','%]');
55
echo $content;

‎install/src/controllers/mode.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,16 @@
1717
}
1818

1919
$ph['moduleName'] = $moduleName;
20-
$ph['displayNew'] = ($upgradeable != 0) ? 'display:none;' : '';
21-
$ph['displayUpg'] = ($upgradeable == 0) ? 'display:none;' : '';
20+
$ph['displayNew'] = ($upgradeable !== 0) ? 'hidden' : '';
21+
$ph['displayUpg'] = ($upgradeable === 0) ? 'hidden' : '';
2222
$ph['displayAdvUpg'] = $ph['displayUpg'];
2323
$ph['checkedNew'] = !$upgradeable ? 'checked' : '';
2424
$ph['checkedUpg'] = (isset($_POST['installmode']) && $_POST['installmode'] == 1 || $upgradeable == 1) ? 'checked' : '';
2525
$ph['checkedAdvUpg'] = (isset($_POST['installmode']) && $_POST['installmode'] == 2 || $upgradeable == 2) ? 'checked' : '';
2626
$ph['install_language'] = $install_language;
2727
$ph['disabledUpg'] = ($upgradeable != 1) ? 'disabled' : '';
2828
$ph['disabledAdvUpg'] = ($upgradeable == 0) ? 'disabled' : '';
29+
$ph['csrf_nonce'] = csrfNonce();
2930

3031
$tpl = file_get_contents(dirname(__DIR__) . '/template/actions/mode.tpl');
3132
$content = parse($tpl, $ph);

0 commit comments

Comments
 (0)