瀏覽代碼

HUE-6846 [frontend] Make all proxy apps embeddable

Enrico Berti 8 年之前
父節點
當前提交
981e38e

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -100,7 +100,7 @@
   ## secure_browser_xss_filter=true
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net data:;img-src 'self' *.google-analytics.com *.doubleclick.net http://*.tile.osm.org *.tile.osm.org *.gstatic.com data:;style-src 'self' 'unsafe-inline' fonts.googleapis.com;connect-src 'self';child-src 'self' data: *.vimeo.com;object-src 'none'"
+  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net data:;img-src 'self' *.google-analytics.com *.doubleclick.net http://*.tile.osm.org *.tile.osm.org *.gstatic.com data:;style-src 'self' 'unsafe-inline' fonts.googleapis.com;connect-src 'self';frame-src *;child-src 'self' data: *.vimeo.com;object-src 'none'"
 
   # Strict-Transport-Security HTTP Strict Transport Security(HSTS) is a policy which is communicated by the server to the user agent via HTTP response header field name “Strict-Transport-Security”. HSTS policy specifies a period of time during which the user agent(browser) should only access the server in a secure fashion(https).
   ## secure_ssl_redirect=False

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -104,7 +104,7 @@
   ## secure_browser_xss_filter=true
 
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
-  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net data:;img-src 'self' *.google-analytics.com *.doubleclick.net http://*.tile.osm.org *.tile.osm.org *.gstatic.com data:;style-src 'self' 'unsafe-inline' fonts.googleapis.com;connect-src 'self';child-src 'self' data: *.vimeo.com;object-src 'none'"
+  ## secure_content_security_policy="script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com *.doubleclick.net data:;img-src 'self' *.google-analytics.com *.doubleclick.net http://*.tile.osm.org *.tile.osm.org *.gstatic.com data:;style-src 'self' 'unsafe-inline' fonts.googleapis.com;connect-src 'self';frame-src *;child-src 'self' data: *.vimeo.com;object-src 'none'"
 
   # Strict-Transport-Security HTTP Strict Transport Security(HSTS) is a policy which is communicated by the server to the user agent via HTTP response header field name “Strict-Transport-Security”. HSTS policy specifies a period of time during which the user agent(browser) should only access the server in a secure fashion(https).
   ## secure_ssl_redirect=False

+ 5 - 1
desktop/core/src/desktop/app_template_proxy/src/app_name/templates/index.mako

@@ -19,7 +19,9 @@ ${'<'}%!from ${app_name}.conf import URL %>
 
 ${'<'}%namespace name="shared" file="shared_components.mako" />
 
+${'%'}if not is_embeddable:
 ${'$'}{commonheader("${" ".join(word.capitalize() for word in app_name.split("_"))}", "${app_name}", user, request, "28px") | n,unicode}
+${'%'}endif
 
 ${'#'}# Use double hashes for a mako template comment
 ${'#'}# Main body
@@ -42,11 +44,13 @@ ${'#'}# Main body
     });
 
     function resizeAppframe() {
-      $("#appframe").height($(window).height() - 34); // magic: navigator height + safety pixels
+      $("#appframe").height($(window).height() - (IS_HUE_4 ? 48 : 34)); // magic: navigator height + safety pixels
     }
 
     resizeAppframe();
   });
 </script>
 
+${'%'}if not is_embeddable:
 ${'$'}{commonfooter(request, messages) | n,unicode}
+${'%'}endif

+ 5 - 1
desktop/core/src/desktop/app_template_proxy/src/app_name/views.py

@@ -19,4 +19,8 @@ from desktop.lib.django_util import render
 import datetime
 
 def index(request):
-  return render('index.mako', request, dict(date=datetime.datetime.now()))
+  return render('index.mako', request, {
+    'date': datetime.datetime.now(),
+    'is_embeddable': request.GET.get('is_embeddable', False),
+  })
+

+ 1 - 0
desktop/core/src/desktop/conf.py

@@ -249,6 +249,7 @@ SECURE_CONTENT_SECURITY_POLICY = Config(
           "img-src 'self' *.google-analytics.com *.doubleclick.net http://*.tile.osm.org *.tile.osm.org *.gstatic.com data:;"+
           "style-src 'self' 'unsafe-inline' fonts.googleapis.com;"+
           "connect-src 'self';"+
+          "frame-src *;"+
           "child-src 'self' data: *.vimeo.com;"+
           "object-src 'none'")