Repository: openmeetings Updated Branches: refs/heads/master 90f73c70a -> 95d1d87a5
[OPENMEETINGS-1747] Content-Security-Policy for Edge should be fixed Project: http://git-wip-us.apache.org/repos/asf/openmeetings/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings/commit/95d1d87a Tree: http://git-wip-us.apache.org/repos/asf/openmeetings/tree/95d1d87a Diff: http://git-wip-us.apache.org/repos/asf/openmeetings/diff/95d1d87a Branch: refs/heads/master Commit: 95d1d87a57265f1a6dc465aea324167e723d43d6 Parents: 90f73c7 Author: Maxim Solodovnik <[email protected]> Authored: Wed Nov 8 16:41:44 2017 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Wed Nov 8 16:42:35 2017 +0700 ---------------------------------------------------------------------- .../openmeetings/web/app/Application.java | 25 +++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings/blob/95d1d87a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java ---------------------------------------------------------------------- diff --git a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java index bd36f4f..25d6828 100644 --- a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java +++ b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java @@ -253,12 +253,8 @@ public class Application extends AuthenticatedWebApplication implements IApplica wresp.setHeader("X-Content-Type-Options", "nosniff"); wresp.setHeader("X-Frame-Options", xFrameOptions); Url reqUrl = cycle.getRequest().getUrl(); - wresp.setHeader("Content-Security-Policy", String.format("%s; connect-src 'self' %s://%s:%s;" - , contentSecurityPolicy - , "http".equalsIgnoreCase(reqUrl.getProtocol()) ? "ws" : "wss" - , reqUrl.getHost() - , reqUrl.getPort() - )); + wresp.setHeader("Content-Security-Policy" + , String.format("%s; connect-src 'self' %s;", contentSecurityPolicy, getWsUrl(reqUrl))); } } }); @@ -892,4 +888,21 @@ public class Application extends AuthenticatedWebApplication implements IApplica public void publishWsTopic(IClusterWsMessage msg) { hazelWsTopic.publish(msg); } + + private String getWsUrl(Url reqUrl) { + final boolean secure = "http".equalsIgnoreCase(reqUrl.getProtocol()); + String delim = ":"; + String port = reqUrl.getPort() == null || reqUrl.getPort() < 0 ? "" : String.valueOf(reqUrl.getPort()); + if (!port.isEmpty() && ((secure && 443 == reqUrl.getPort()) || (!secure && 80 == reqUrl.getPort()))) { + port = ""; + } + if (port.isEmpty()) { + delim = ""; + } + return String.format("%s://%s%s%s;" + , secure ? "ws" : "wss" + , reqUrl.getHost() + , delim + , port); + } }
