Selaa lähdekoodia

HUE-4575 [core] Add notice to hue.ini regarding the custom maps and security

Enrico Berti 9 vuotta sitten
vanhempi
commit
76a8068

+ 2 - 1
desktop/conf.dist/hue.ini

@@ -91,7 +91,7 @@
   ## secure_browser_xss_filter=true
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net *.mathjax.org data:;img-src 'self' *.google-analytics.com *.doubleclick.net data:;style-src 'self' 'unsafe-inline';connect-src 'self';child-src 'none';object-src 'none'"
+  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net *.mathjax.org data:;img-src 'self' *.google-analytics.com *.doubleclick.net *.tile.osm.org data:;style-src 'self' 'unsafe-inline';connect-src 'self';child-src 'none';object-src 'none'"
 
   # Strict-Transport-Security HTTP Strict Transport Security(HSTS) is a policy which is communicated by the server to the user agent via HTTP response header field name “Strict-Transport-Security”. HSTS policy specifies a period of time during which the user agent(browser) should only access the server in a secure fashion(https).
   ## secure_ssl_redirect=False
@@ -129,6 +129,7 @@
 
   # Tile layer server URL for the Leaflet map charts
   # Read more on http://leafletjs.com/reference.html#tilelayer
+  # Make sure you add the tile domain to the img-src section of the 'secure_content_security_policy' configuration parameter as well.
   ## leaflet_tile_layer=http://{s}.tile.osm.org/{z}/{x}/{y}.png
 
   # The copyright message for the specified Leaflet maps Tile Layer

+ 2 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -95,7 +95,7 @@
   ## secure_browser_xss_filter=true
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net *.mathjax.org data:;img-src 'self' *.google-analytics.com *.doubleclick.net data:;style-src 'self' 'unsafe-inline';connect-src 'self';child-src 'none';object-src 'none'"
+  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net *.mathjax.org data:;img-src 'self' *.google-analytics.com *.doubleclick.net *.tile.osm.org data:;style-src 'self' 'unsafe-inline';connect-src 'self';child-src 'none';object-src 'none'"
 
   # Strict-Transport-Security HTTP Strict Transport Security(HSTS) is a policy which is communicated by the server to the user agent via HTTP response header field name “Strict-Transport-Security”. HSTS policy specifies a period of time during which the user agent(browser) should only access the server in a secure fashion(https).
   ## secure_ssl_redirect=False
@@ -133,6 +133,7 @@
 
   # Tile layer server URL for the Leaflet map charts
   # Read more on http://leafletjs.com/reference.html#tilelayer
+  # Make sure you add the tile domain to the img-src section of the 'secure_content_security_policy' configuration parameter as well.
   ## leaflet_tile_layer=http://{s}.tile.osm.org/{z}/{x}/{y}.png
 
   # The copyright message for the specified Leaflet maps Tile Layer

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -322,7 +322,7 @@ COLLECT_USAGE = Config(
 
 LEAFLET_TILE_LAYER = Config(
   key="leaflet_tile_layer",
-  help=_("Tile layer server URL for the Leaflet map charts. Read more on http://leafletjs.com/reference.html#tilelayer"),
+  help=_("Tile layer server URL for the Leaflet map charts. Read more on http://leafletjs.com/reference.html#tilelayer. Make sure you add the tile domain to the img-src section of the 'secure_content_security_policy' configuration parameter as well."),
   type=coerce_str_lowercase,
   default="http://{s}.tile.osm.org/{z}/{x}/{y}.png")