From 815d9f203ecc324d1e5ffd3664f9351d7797821f Mon Sep 17 00:00:00 2001 From: Daniel Winzen Date: Wed, 14 Oct 2020 13:38:30 +0200 Subject: [PATCH] Improved CSP rules --- chat.php | 181 ++++++++++++++++++++++++++++++------------------------- 1 file changed, 99 insertions(+), 82 deletions(-) diff --git a/chat.php b/chat.php index 588bd96..1f2ef8f 100644 --- a/chat.php +++ b/chat.php @@ -32,7 +32,6 @@ * 9 - Private messages */ -send_headers(); // initialize and load variables/configuration $I=[];// Translations $L=[];// Languages @@ -40,6 +39,7 @@ $U=[];// This user data $db;// Database connection $memcached;// Memcached connection $language;// user selected language +$styles = []; //css styles load_config(); // set session variable to cookie if cookies are enabled if(!isset($_REQUEST['session']) && isset($_COOKIE[COOKIENAME])){ @@ -249,35 +249,33 @@ function route_setup(){ } // html output subs -function print_stylesheet($init=false){ - global $U; - //default css - echo ''; - if($init){ + $styles['default'] .= 's forwards;z-index:2;background-color:#500000;border:2px solid #ff0000} '; + $styles['default'] .= '@keyframes timeout_messages{0%{top:-200%} 99%{top:-200%} 100%{top:0%}} '; + $styles['default'] .= '.notes textarea{height:80vh;width:80%}'; + if($init || ! $db instanceof PDO){ return; } $css=get_setting('css'); @@ -287,8 +285,18 @@ function print_stylesheet($init=false){ }else{ $colbg=get_setting('colbg'); } + $styles['custom'] = preg_replace("/(\r?\n|\r\n?)/u", '', "body{background-color:#$colbg;color:#$coltxt} $css"); +} + +function print_stylesheet($init = false){ + global $styles; + //default css + echo ""; + if($init){ + return; + } //overwrite with custom css - echo ""; + echo ""; } function print_end(){ @@ -301,7 +309,7 @@ function credit(){ } function meta_html(){ - return ''; + return ''; } function form($action, $do=''){ @@ -342,6 +350,8 @@ function thr(){ function print_start($class='', $ref=0, $url=''){ global $I; + prepare_stylesheets($class === 'init'); + send_headers(); if(!empty($url)){ $url=str_replace('&', '&', $url);// Don't escape "&" in URLs here, it breaks some (older) browsers and js refresh! header("Refresh: $ref; URL=$url"); @@ -349,9 +359,6 @@ function print_start($class='', $ref=0, $url=''){ echo ''.meta_html(); if(!empty($url)){ echo ""; - $ref+=5;//only use js if browser refresh stopped working - $ref*=1000;//js uses milliseconds - echo ""; } if($class==='init'){ echo "$I[init]"; @@ -393,7 +400,7 @@ function send_redirect($url){ function send_access_denied(){ global $I, $U; - header('HTTP/1.1 403 Forbidden'); + http_response_code(403); print_start('access_denied'); echo "

$I[accessdenied]

".sprintf($I['loggedinas'], style_this(htmlspecialchars($U['nickname']), $U['style'])).'
'; echo form('logout'); @@ -773,7 +780,7 @@ function restore_backup($C){ $note['type']=1; } if(MSGENCRYPTED){ - $note['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($note['text'], '', AES_IV, ENCRYPTKEY)); + $note['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($note['text'], '', AES_IV, ENCRYPTKEY)); } $stmt->execute([$note['type'], $note['lastedited'], $note['editedby'], $note['text']]); } @@ -809,7 +816,7 @@ function send_backup($C){ $result=$db->query('SELECT * FROM ' . PREFIX . "notes;"); while($note=$result->fetch(PDO::FETCH_ASSOC)){ if(MSGENCRYPTED){ - $note['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($note['text']), null, AES_IV, ENCRYPTKEY); + $note['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($note['text']), null, AES_IV, ENCRYPTKEY); } $code['notes'][]=$note; } @@ -1392,6 +1399,8 @@ function send_linkfilter($arg=''){ function send_frameset(){ global $I, $U, $db, $language; + prepare_stylesheets(); + send_headers(); echo ''.meta_html(); echo ''.get_setting('chatname').''; print_stylesheet(); @@ -1544,7 +1553,7 @@ function send_notes($type){ } if(isset($_REQUEST['text'])){ if(MSGENCRYPTED){ - $_REQUEST['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($_REQUEST['text'], '', AES_IV, ENCRYPTKEY)); + $_REQUEST['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($_REQUEST['text'], '', AES_IV, ENCRYPTKEY)); } $time=time(); $stmt=$db->prepare('INSERT INTO ' . PREFIX . 'notes (type, lastedited, editedby, text) VALUES (?, ?, ?, ?);'); @@ -1578,7 +1587,7 @@ function send_notes($type){ $note['text']=''; } if(MSGENCRYPTED){ - $note['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($note['text']), null, AES_IV, ENCRYPTKEY); + $note['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($note['text']), null, AES_IV, ENCRYPTKEY); } echo "

".form('notes'); echo "$hiddendo
'; @@ -1860,7 +1869,7 @@ function send_profile($arg=''){ } echo "
$I[ignore]"; echo "