Repository: openmeetings Updated Branches: refs/heads/master 306baba48 -> 4ea8152ec
no jira: Security HTTP headers need to be set Project: http://git-wip-us.apache.org/repos/asf/openmeetings/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings/commit/4ea8152e Tree: http://git-wip-us.apache.org/repos/asf/openmeetings/tree/4ea8152e Diff: http://git-wip-us.apache.org/repos/asf/openmeetings/diff/4ea8152e Branch: refs/heads/master Commit: 4ea8152ec367c7c374ea4d956191bd24128e7496 Parents: 306baba Author: Maxim Solodovnik <[email protected]> Authored: Tue May 16 16:30:32 2017 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Tue May 16 16:37:08 2017 +0700 ---------------------------------------------------------------------- .../core/remote/ScopeApplicationAdapter.java | 16 ++++++--- .../org/apache/openmeetings/IApplication.java | 2 ++ .../db/dao/basic/ConfigurationDao.java | 38 ++++++++++++++++---- .../installation/ImportInitvalues.java | 6 ++++ .../src/site/xdoc/GeneralConfiguration.xml | 21 +++++++---- .../util/OpenmeetingsVariables.java | 4 +++ .../openmeetings/web/app/Application.java | 30 ++++++++++++++++ .../org/apache/openmeetings/web/pages/om-ga.js | 13 +++---- 8 files changed, 104 insertions(+), 26 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-core/src/main/java/org/apache/openmeetings/core/remote/ScopeApplicationAdapter.java ---------------------------------------------------------------------- diff --git a/openmeetings-core/src/main/java/org/apache/openmeetings/core/remote/ScopeApplicationAdapter.java b/openmeetings-core/src/main/java/org/apache/openmeetings/core/remote/ScopeApplicationAdapter.java index e8af7b1..a608d57 100644 --- a/openmeetings-core/src/main/java/org/apache/openmeetings/core/remote/ScopeApplicationAdapter.java +++ b/openmeetings-core/src/main/java/org/apache/openmeetings/core/remote/ScopeApplicationAdapter.java @@ -21,7 +21,12 @@ package org.apache.openmeetings.core.remote; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_FLASH_SECURE; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_FLASH_SECURE_PROXY; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_FLASH_VIDEO_CODEC; +import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_HEADER_CSP; +import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_HEADER_XFRAME; +import static org.apache.openmeetings.util.OpenmeetingsVariables.HEADER_CSP_SELF; +import static org.apache.openmeetings.util.OpenmeetingsVariables.HEADER_XFRAME_SAMEORIGIN; import static org.apache.openmeetings.util.OpenmeetingsVariables.webAppRootKey; +import static org.apache.openmeetings.util.OpenmeetingsVariables.wicketApplicationName; import java.io.File; import java.io.FileInputStream; @@ -50,8 +55,8 @@ import org.apache.openmeetings.db.dao.server.ServerDao; import org.apache.openmeetings.db.dao.server.SessiondataDao; import org.apache.openmeetings.db.dao.user.UserDao; import org.apache.openmeetings.db.entity.log.ConferenceLog; -import org.apache.openmeetings.db.entity.room.StreamClient; import org.apache.openmeetings.db.entity.room.Room; +import org.apache.openmeetings.db.entity.room.StreamClient; import org.apache.openmeetings.db.entity.server.Server; import org.apache.openmeetings.db.entity.server.Sessiondata; import org.apache.openmeetings.db.entity.user.User; @@ -152,6 +157,9 @@ public class ScopeApplicationAdapter extends MultiThreadedApplicationAdapter imp } InitializationContainer.initComplete = true; + IApplication iapp = (IApplication)Application.get(wicketApplicationName); + iapp.setXFrameOptions(cfgDao.getConfValue(CONFIG_HEADER_XFRAME, String.class, HEADER_XFRAME_SAMEORIGIN)); + iapp.setContentSecurityPolicy(cfgDao.getConfValue(CONFIG_HEADER_CSP, String.class, HEADER_CSP_SELF)); Version.logOMStarted(); recordingDao.resetProcessingStatus(); //we are starting so all processing recordings are now errors sessionManager.clearCache(); // 'sticky' clients should be cleaned up from DB @@ -197,7 +205,7 @@ public class ScopeApplicationAdapter extends MultiThreadedApplicationAdapter imp StringValue scn = StringValue.valueOf(conn.getScope().getName()); long roomId = scn.toLong(Long.MIN_VALUE); StreamClient rcm = new StreamClient(); - IApplication iapp = (IApplication)Application.get(OpenmeetingsVariables.wicketApplicationName); + IApplication iapp = (IApplication)Application.get(wicketApplicationName); if (!Strings.isEmpty(securityCode)) { //this is for external applications like ffmpeg [OPENMEETINGS-1574] if (roomId < 0) { @@ -507,7 +515,7 @@ public class ScopeApplicationAdapter extends MultiThreadedApplicationAdapter imp if (client.isScreenClient() && client.isStartStreaming()) { //TODO check others/find better way WebSocketHelper.sendRoom(new TextRoomMessage(client.getRoomId(), client.getUserId(), RoomMessage.Type.sharingStoped, client.getStreamPublishName())); - } + } if (client.getIsBroadcasting()) { WebSocketHelper.sendRoom(new TextRoomMessage(client.getRoomId(), client.getUserId(), RoomMessage.Type.closeStream, client.getPublicSID())); } @@ -553,7 +561,7 @@ public class ScopeApplicationAdapter extends MultiThreadedApplicationAdapter imp }.start(); if (client.isMobile()) { - IApplication app = (IApplication)Application.get(OpenmeetingsVariables.wicketApplicationName); + IApplication app = (IApplication)Application.get(wicketApplicationName); app.exit(client.getPublicSID()); } sessionManager.removeClient(client.getStreamid(), null); http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-db/src/main/java/org/apache/openmeetings/IApplication.java ---------------------------------------------------------------------- diff --git a/openmeetings-db/src/main/java/org/apache/openmeetings/IApplication.java b/openmeetings-db/src/main/java/org/apache/openmeetings/IApplication.java index 799b2aa..7cd5c29 100644 --- a/openmeetings-db/src/main/java/org/apache/openmeetings/IApplication.java +++ b/openmeetings-db/src/main/java/org/apache/openmeetings/IApplication.java @@ -48,4 +48,6 @@ public interface IApplication { String urlForActivatePage(PageParameters pp); void invalidateClient(Long userId, String sessionId); void exit(String uid); + void setXFrameOptions(String xFrameOptions); + void setContentSecurityPolicy(String contentSecurityPolicy); } http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java ---------------------------------------------------------------------- diff --git a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java index 3e054a0..3697e01 100644 --- a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java +++ b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java @@ -22,12 +22,15 @@ import static org.apache.openmeetings.util.OpenmeetingsVariables.APPLICATION_NAM import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_APPLICATION_BASE_URL; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_APPLICATION_NAME; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_CRYPT_KEY; +import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_HEADER_CSP; +import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_HEADER_XFRAME; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_MAX_UPLOAD_SIZE_KEY; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_SIP_ENABLED; import static org.apache.openmeetings.util.OpenmeetingsVariables.DEFAULT_BASE_URL; import static org.apache.openmeetings.util.OpenmeetingsVariables.configKeyCryptClassName; import static org.apache.openmeetings.util.OpenmeetingsVariables.webAppRootKey; import static org.apache.openmeetings.util.OpenmeetingsVariables.whiteboardDrawStatus; +import static org.apache.openmeetings.util.OpenmeetingsVariables.wicketApplicationName; import java.lang.reflect.Constructor; import java.util.ArrayList; @@ -39,10 +42,12 @@ import javax.persistence.EntityManager; import javax.persistence.PersistenceContext; import javax.persistence.TypedQuery; +import org.apache.openmeetings.IApplication; import org.apache.openmeetings.db.dao.IDataProviderDao; import org.apache.openmeetings.db.dao.user.UserDao; import org.apache.openmeetings.db.entity.basic.Configuration; import org.apache.openmeetings.util.DaoHelper; +import org.apache.wicket.Application; import org.red5.logging.Red5LoggerFactory; import org.slf4j.Logger; import org.springframework.beans.factory.annotation.Autowired; @@ -230,14 +235,33 @@ public class ConfigurationDao implements IDataProviderDao<Configuration> { entity.setUpdated(new Date()); entity = em.merge(entity); } - if (CONFIG_CRYPT_KEY.equals(key)) { - configKeyCryptClassName = value; - } else if ("show.whiteboard.draw.status".equals(key)) { - whiteboardDrawStatus = Boolean.valueOf("1".equals(value)); - } else if (CONFIG_APPLICATION_NAME.equals(key)) { - APPLICATION_NAME = value; + switch (key) { + case CONFIG_CRYPT_KEY: + configKeyCryptClassName = value; + break; + case "show.whiteboard.draw.status": + whiteboardDrawStatus = Boolean.valueOf("1".equals(value)); + break; + case CONFIG_APPLICATION_NAME: + APPLICATION_NAME = value; + break; + case CONFIG_HEADER_XFRAME: + { + IApplication iapp = (IApplication)Application.get(wicketApplicationName); + if (iapp != null) { + iapp.setXFrameOptions(value); + } + } + break; + case CONFIG_HEADER_CSP: + { + IApplication iapp = (IApplication)Application.get(wicketApplicationName); + if (iapp != null) { + iapp.setContentSecurityPolicy(value); + } + } + break; } - //TODO ensure entity returned is updated return entity; } http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java ---------------------------------------------------------------------- diff --git a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java index 8ec1230..44c5331 100644 --- a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java +++ b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java @@ -40,6 +40,8 @@ import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_FLASH_VI import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_FLASH_VIDEO_FPS; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_FRONTEND_REGISTER_KEY; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_GOOGLE_ANALYTICS_CODE; +import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_HEADER_CSP; +import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_HEADER_XFRAME; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_IGNORE_BAD_SSL; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_IMAGEMAGIC_PATH; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_LOGIN_MIN_LENGTH_KEY; @@ -56,6 +58,8 @@ import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_SCREENSH import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_SIP_ENABLED; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_SOAP_REGISTER_KEY; import static org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_SYSTEM_EMAIL; +import static org.apache.openmeetings.util.OpenmeetingsVariables.HEADER_CSP_SELF; +import static org.apache.openmeetings.util.OpenmeetingsVariables.HEADER_XFRAME_SAMEORIGIN; import static org.apache.openmeetings.util.OpenmeetingsVariables.LEVEL_ADMIN; import static org.apache.openmeetings.util.OpenmeetingsVariables.LEVEL_GROUP_ADMIN; import static org.apache.openmeetings.util.OpenmeetingsVariables.LEVEL_USER; @@ -361,6 +365,8 @@ public class ImportInitvalues { cfgDao.add(CONFIG_FLASH_VIDEO_CODEC, "h263", null, "Camera codecType, possible values: 'h263', 'h264'"); cfgDao.add(CONFIG_FLASH_VIDEO_FPS, "30", null, "Camera FPS, should be positive number in range (0, 60]"); + cfgDao.add(CONFIG_HEADER_XFRAME, HEADER_XFRAME_SAMEORIGIN, null, "Value for 'X-Frame-Options' header (default: DENY), more info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options";); + cfgDao.add(CONFIG_HEADER_CSP, HEADER_CSP_SELF, null, "Value for 'Content-Security-Policy' header (default: default-src 'self';), have to be modified to enable Google analytics site: https://content-security-policy.com/";); log.debug("Configurations ADDED"); } http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml ---------------------------------------------------------------------- diff --git a/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml b/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml index bb2e791..31622aa 100644 --- a/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml +++ b/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml @@ -13,16 +13,13 @@ limitations under the License. --> <document xmlns="http://maven.apache.org/XDOC/2.0"; - xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; - xsi:schemaLocation="http://maven.apache.org/XDOC/2.0 http://maven.apache.org/xsd/xdoc-2.0.xsd";> - + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; + xsi:schemaLocation="http://maven.apache.org/XDOC/2.0 http://maven.apache.org/xsd/xdoc-2.0.xsd";> <properties> <title>List of general configuration options</title> <author email="[email protected]">Apache OpenMeetings Team</author> </properties> - <body> - <section name="List of general configuration options"> <p>In Administration > Configuration there are a number of configuration values. @@ -298,9 +295,19 @@ <td> Code for Google Analytics. </td> <td> 3.1.0 </td> </tr> + <tr> + <td> header.x.frame.options </td> + <td> SAMEORIGIN </td> + <td> Value for 'X-Frame-Options' header, more info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options </td> + <td> 3.3.0 </td> + </tr> + <tr> + <td> header.content.security.policy </td> + <td> default-src 'self'; </td> + <td> Value for 'Content-Security-Policy' header, have to be modified to enable Google analytics site: https://content-security-policy.com/ </td> + <td> 3.3.0 </td> + </tr> </table> </section> - </body> - </document> http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java ---------------------------------------------------------------------- diff --git a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java index f7b6c35..e314bfb 100644 --- a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java +++ b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java @@ -55,6 +55,10 @@ public class OpenmeetingsVariables { public static final String CONFIG_FLASH_SECURE_PROXY = "flash.secure.proxy"; public static final String CONFIG_FLASH_VIDEO_CODEC = "flash.video.codec"; public static final String CONFIG_FLASH_VIDEO_FPS = "flash.video.fps"; + public static final String CONFIG_HEADER_XFRAME = "header.x.frame.options"; + public static final String HEADER_XFRAME_SAMEORIGIN = "SAMEORIGIN"; + public static final String HEADER_CSP_SELF = "default-src 'self';"; + public static final String CONFIG_HEADER_CSP = "header.content.security.policy"; public static final String MENU_ROOMS_NAME = "Conference Rooms"; public static final int RECENT_ROOMS_COUNT = 5; public static final int LEVEL_USER = 1; http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java ---------------------------------------------------------------------- diff --git a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java index d5a637c..18242a5 100644 --- a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java +++ b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java @@ -19,6 +19,7 @@ package org.apache.openmeetings.web.app; import static org.apache.openmeetings.core.util.WebSocketHelper.sendRoom; +import static org.apache.openmeetings.util.OpenmeetingsVariables.HEADER_XFRAME_SAMEORIGIN; import static org.apache.openmeetings.util.OpenmeetingsVariables.webAppRootKey; import static org.apache.openmeetings.util.OpenmeetingsVariables.wicketApplicationName; import static org.apache.openmeetings.web.pages.HashPage.INVITATION_HASH; @@ -60,6 +61,7 @@ import org.apache.openmeetings.db.entity.room.StreamClient; import org.apache.openmeetings.db.entity.user.User; import org.apache.openmeetings.db.entity.user.User.Type; import org.apache.openmeetings.util.InitializationContainer; +import org.apache.openmeetings.util.OpenmeetingsVariables; import org.apache.openmeetings.util.message.RoomMessage; import org.apache.openmeetings.web.pages.AccessDeniedPage; import org.apache.openmeetings.web.pages.ActivatePage; @@ -96,10 +98,13 @@ import org.apache.wicket.markup.html.WebPage; import org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener; import org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler; import org.apache.wicket.protocol.ws.api.WebSocketRequestHandler; +import org.apache.wicket.protocol.ws.api.WebSocketResponse; import org.apache.wicket.request.IRequestHandler; +import org.apache.wicket.request.Response; import org.apache.wicket.request.Url; import org.apache.wicket.request.component.IRequestablePage; import org.apache.wicket.request.cycle.RequestCycle; +import org.apache.wicket.request.http.WebResponse; import org.apache.wicket.request.mapper.info.PageComponentInfo; import org.apache.wicket.request.mapper.parameter.PageParameters; import org.apache.wicket.request.mapper.parameter.PageParametersEncoder; @@ -130,6 +135,8 @@ public class Application extends AuthenticatedWebApplication implements IApplica public static final String HASH_MAPPING = "/hash"; public static final String SIGNIN_MAPPING = "/signin"; public static final String NOTINIT_MAPPING = "/notinited"; + private String xFrameOptions = HEADER_XFRAME_SAMEORIGIN; + private String contentSecurityPolicy = OpenmeetingsVariables.HEADER_CSP_SELF; @Override protected void init() { @@ -145,6 +152,19 @@ public class Application extends AuthenticatedWebApplication implements IApplica getJavaScriptLibrarySettings().setJQueryReference(JQueryResourceReference.getV2()); getRequestCycleListeners().add(new CsrfPreventionRequestCycleListener() { @Override + public void onEndRequest(RequestCycle cycle) { + Response resp = cycle.getResponse(); + if (resp instanceof WebResponse && !(resp instanceof WebSocketResponse)) { + WebResponse wresp = (WebResponse)resp; + wresp.setHeader("X-XSS-Protection", "1; mode=block"); + wresp.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload"); + wresp.setHeader("X-Content-Type-Options", "nosniff"); + wresp.setHeader("X-Frame-Options", xFrameOptions); + wresp.setHeader("Content-Security-Policy", contentSecurityPolicy); + } + } + + @Override protected boolean isChecked(IRequestHandler handler) { if (handler instanceof WebSocketRequestHandler || handler instanceof WebSocketMessageBroadcastHandler) { return false; @@ -651,4 +671,14 @@ public class Application extends AuthenticatedWebApplication implements IApplica public Client getOmClient(String uid) { return getOnlineClient(uid); } + + @Override + public void setXFrameOptions(String xFrameOptions) { + this.xFrameOptions = xFrameOptions; + } + + @Override + public void setContentSecurityPolicy(String contentSecurityPolicy) { + this.contentSecurityPolicy = contentSecurityPolicy; + } } http://git-wip-us.apache.org/repos/asf/openmeetings/blob/4ea8152e/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/om-ga.js ---------------------------------------------------------------------- diff --git a/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/om-ga.js b/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/om-ga.js index d5b7f12..a3226af 100644 --- a/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/om-ga.js +++ b/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/om-ga.js @@ -24,19 +24,16 @@ a=s.createElement(o),m=s.getElementsByTagName(o)[0]; a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); - function initGA(code) { ga('create', code, 'auto'); } - function init() { - ga('send', 'pageview'); + ga('send', 'pageview'); } - function initHash() { - ga('send', 'pageview', window.location.hash); + ga('send', 'pageview', window.location.hash); - $(window).bind( 'hashchange', function( e ) { - ga('send', 'pageview', window.location.hash); - }); + $(window).bind( 'hashchange', function( e ) { + ga('send', 'pageview', window.location.hash); + }); }
