[
https://issues.apache.org/jira/browse/OPENMEETINGS-2247?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17086065#comment-17086065
]
Sebastian Wagner commented on OPENMEETINGS-2247:
------------------------------------------------
Caching those config values doesn't mean you need to call the WebApplication.
I guess what bothers me
is:[https://github.com/apache/openmeetings/blob/master/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java#L650]
{code:java}
final CSPHeaderConfiguration cspConfig =
WebApplication.get().getCspSettings().blocking().strict();{code}
That is a static method to configure the WebApplication.
It should be the other way round. The ConfigurationDao could just return a list
of statically cached values. You could even have a generic method:
{code:java}
public List<Configuration> get(String... keys, boolean cache) { .... }{code}
And if cache == true you buffer the results in a local field like:
{code:java}
static final List<Configuration> cachedConfigs = new ArrayList<>();{code}
And before making a query to the DB, you iterate through this list and return
those values first.
And the Application.java just calls this method with cache = true when it
builds the header values.
And on updating a Configuration via Admin panel, you just iterate or (simply
call cachedConfigs.clear()) to flush it. And it will cache it on the next call
to the method again.
That way you decouple the web-application from the DB layer. DB layer is okay
to cache things. But I don't think it should have logic how to configure
headers for the web-application.
> CSP should be re-worked
> -----------------------
>
> Key: OPENMEETINGS-2247
> URL: https://issues.apache.org/jira/browse/OPENMEETINGS-2247
> Project: Openmeetings
> Issue Type: Task
> Components: Builds, UI
> Affects Versions: 5.0.0-M4
> Reporter: Maxim Solodovnik
> Assignee: Maxim Solodovnik
> Priority: Major
> Fix For: 5.0.0-M4
>
> Attachments: image-2020-04-17-14-37-11-501.png,
> image-2020-04-17-14-59-08-307.png, image-2020-04-17-15-16-37-187.png
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Previously CSP was implemented via
> {{header.csp.frame.options}} and {{header.content.security.policy}}
> https://openmeetings.apache.org/GeneralConfiguration.html
> Above setting were applied here
> https://github.com/apache/openmeetings/blob/5.0.0-M3/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/Application.java#L244
> This should be re-worked
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
