fix: correct CSP directive for login and account templates (#47)

corona-warn-app · Jul 10, 2020 · c60396e · c60396e
1 parent d043f96
commit c60396e
Show file tree

Hide file tree

Showing 6 changed files with 10 additions and 8 deletions.
diff --git a/src/themes/cwa/account/resources/logout.js b/src/themes/cwa/account/resources/logout.js
@@ -1,3 +1,5 @@
+document.getElementById("popup-menu").addEventListener("click", showUserPopup);
+
 function showUserPopup() {
   var popup = document.getElementById("logout");
   popup.classList.toggle("show");

diff --git a/src/themes/cwa/account/template.ftl b/src/themes/cwa/account/template.ftl
@@ -3,12 +3,11 @@
 <html>
   <head>
     <meta charset="utf-8">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' style-src 'unsafe-inline'">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self'"/>
     <meta name="robots" content="noindex, nofollow">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <link rel="icon" href="${url.resourcesPath}/img/c-19_logo.png">
     <link rel="stylesheet" type="text/css" href="${url.resourcesPath}/password.css">
-    <script src="${url.resourcesPath}/logout.js"></script>
     <title>${msg("changePasswordHtmlTitle")}</title>
   </head>
   <body>
@@ -31,12 +30,13 @@
       </tr>
     </table>
 
-    <table class="user" onclick="showUserPopup()">
+    <table id="popup-menu" class="user">
       <tr>
-        <td><img  src="${url.resourcesPath}/img/user.png"/></td>
+        <td><img src="${url.resourcesPath}/img/user.png"/></td>
         <td style="padding-left: 10px;">${(account.username!'')}<td/>
       </tr>
     </table>
+    <script src="${url.resourcesPath}/logout.js"></script>
     <a href="${url.logoutUrl}"><button class="button-logout" id="logout">${msg("doSignOut")}</button></a>
 
     <#if message?has_content>

diff --git a/src/themes/cwa/login/login-config-totp.ftl b/src/themes/cwa/login/login-config-totp.ftl
@@ -2,7 +2,7 @@
 <html lang="de">
 <head>
   <meta charset="utf-8">
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self' style-src 'unsafe-inline'">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:"/>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <link rel="stylesheet" type="text/css" href="${url.resourcesPath}/teletan.css"/>
   <title>TeleTAN Portal</title>

diff --git a/src/themes/cwa/login/login-otp.ftl b/src/themes/cwa/login/login-otp.ftl
@@ -2,7 +2,7 @@
 <html lang="de">
 <head>
   <meta charset="utf-8">
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self' style-src 'unsafe-inline'"/>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'"/>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <link rel="stylesheet" type="text/css" href="${url.resourcesPath}/teletan.css"/>
   <title>TeleTAN Portal</title>

diff --git a/src/themes/cwa/login/login-update-password.ftl b/src/themes/cwa/login/login-update-password.ftl
@@ -2,7 +2,7 @@
 <html lang="de">
 <head>
   <meta charset="utf-8">
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self' style-src 'unsafe-inline'">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'"/>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <link rel="stylesheet" type="text/css" href="${url.resourcesPath}/teletan.css"/>
   <title>TeleTAN Portal</title>

diff --git a/src/themes/cwa/login/login.ftl b/src/themes/cwa/login/login.ftl
@@ -2,7 +2,7 @@
 <html lang="de">
 <head>
   <meta charset="utf-8">
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self' style-src 'unsafe-inline'">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'"/>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <link rel="stylesheet" type="text/css" href="${url.resourcesPath}/teletan.css"/>
   <title>TeleTAN Portal</title>