Changeset 3432:4e82fa3c576d

Timestamp:

12/02/16 11:54:52 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Ugly hack for SQLite CB driver for value beginning or ending by a single quote

Files:

• admin/install/index.php (modified) (1 diff)
• inc/admin/lib.dc.page.php (modified) (1 diff)
• inc/dbschema/upgrade.php (modified) (1 diff)

admin/install/index.php

@@ -171 +171 @@
 
           # CSP directive (admin part)
+
+          // SQlite Clearbricks driver does not allow using single quote at beginning or end of a field value
+          // so we have to use neutral values (localhost and 127.0.0.1) for some CSP directives
+          $csp_prefix = $core->con->driver() == 'sqlite' ? 'localhost ' : '';   // Hack for SQlite Clearbricks driver
+          $csp_suffix = $core->con->driver() == 'sqlite' ? ' 127.0.0.1' : '';   // Hack for SQlite Clearbricks driver
+
           $blog_settings->system->put('csp_admin_on',true,'boolean','Send CSP header (admin)',true,true);
           $blog_settings->system->put('csp_admin_report_only',false,'boolean','CSP Report only violations (admin)',true,true);
-          $blog_settings->system->put('csp_admin_default',"'self'",'string','CSP default-src directive',true,true);
-          $blog_settings->system->put('csp_admin_script',"'self' 'unsafe-inline' 'unsafe-eval'",'string','CSP script-src directive',true,true);
-          $blog_settings->system->put('csp_admin_style',"'self' 'unsafe-inline'",'string','CSP style-src directive',true,true);
-          $blog_settings->system->put('csp_admin_img',"'self' data: media.dotaddict.org blob:",'string','CSP img-src directive',true,true);
+          $blog_settings->system->put('csp_admin_default',
+               $csp_prefix."'self'".$csp_suffix,'string','CSP default-src directive',true,true);
+          $blog_settings->system->put('csp_admin_script',
+               $csp_prefix."'self' 'unsafe-inline' 'unsafe-eval'".$csp_suffix,'string','CSP script-src directive',true,true);
+          $blog_settings->system->put('csp_admin_style',
+               $csp_prefix."'self' 'unsafe-inline'".$csp_suffix,'string','CSP style-src directive',true,true);
+          $blog_settings->system->put('csp_admin_img',
+               $csp_prefix."'self' data: media.dotaddict.org blob:",'string','CSP img-src directive',true,true);
 
           # Add Dotclear version

inc/admin/lib.dc.page.php

@@ -106 +106 @@
                // Get directives from settings if exist, else set defaults
                $csp = new ArrayObject(array());
-               $csp['default-src'] = $core->blog->settings->system->csp_admin_default ?: "'self'";
-               $csp['script-src'] = $core->blog->settings->system->csp_admin_script ?: "'self' 'unsafe-inline' 'unsafe-eval'";
-               $csp['style-src'] = $core->blog->settings->system->csp_admin_style ?: "'self' 'unsafe-inline'";
-               $csp['img-src'] = $core->blog->settings->system->csp_admin_img ?: "'self' data: media.dotaddict.org blob:";
+
+               // SQlite Clearbricks driver does not allow using single quote at beginning or end of a field value
+               // so we have to use neutral values (localhost and 127.0.0.1) for some CSP directives
+               $csp_prefix = $core->con->driver() == 'sqlite' ? 'localhost ' : '';   // Hack for SQlite Clearbricks driver
+               $csp_suffix = $core->con->driver() == 'sqlite' ? ' 127.0.0.1' : '';   // Hack for SQlite Clearbricks driver
+
+               $csp['default-src'] = $core->blog->settings->system->csp_admin_default ?:
+                    $csp_prefix."'self'".$csp_suffix;
+               $csp['script-src'] = $core->blog->settings->system->csp_admin_script ?:
+                    $csp_prefix."'self' 'unsafe-inline' 'unsafe-eval'".$csp_suffix;
+               $csp['style-src'] = $core->blog->settings->system->csp_admin_style ?:
+                    $csp_prefix."'self' 'unsafe-inline'".$csp_suffix;
+               $csp['img-src'] = $core->blog->settings->system->csp_admin_img ?:
+                    $csp_prefix."'self' data: media.dotaddict.org blob:";
 
                # Cope with blog post preview (via public URL in iframe)

inc/dbschema/upgrade.php

@@ -602 +602 @@
                     sprintf($strReq,'csp_admin_report_only',false,'boolean','CSP Report only violations (admin)'));
 
+               // SQlite Clearbricks driver does not allow using single quote at beginning or end of a field value
+               // so we have to use neutral values (localhost and 127.0.0.1) for some CSP directives
+               $csp_prefix = $core->con->driver() == 'sqlite' ? 'localhost ' : '';   // Hack for SQlite Clearbricks driver
+               $csp_suffix = $core->con->driver() == 'sqlite' ? ' 127.0.0.1' : '';   // Hack for SQlite Clearbricks driver
+
+               # Try to fix some CSP directive wrongly stored for SQLite drivers
+               $strReq = 'UPDATE '.$core->prefix.'setting '.
+                         " SET setting_value = '".$csp_prefix."''self''".$csp_suffix."' ".
+                         " WHERE setting_id = 'csp_admin_default' ".
+                         " AND setting_ns = 'system' ".
+                         " AND setting_value = 'self' ";
+               $core->con->execute($strReq);
+               $strReq = 'UPDATE '.$core->prefix.'setting '.
+                         " SET setting_value = '".$csp_prefix."''self'' ''unsafe-inline'' ''unsafe-eval''".$csp_suffix."' ".
+                         " WHERE setting_id = 'csp_admin_script' ".
+                         " AND setting_ns = 'system' ".
+                         " AND setting_value = 'self'' ''unsafe-inline'' ''unsafe-eval' ";
+               $core->con->execute($strReq);
+               $strReq = 'UPDATE '.$core->prefix.'setting '.
+                         " SET setting_value = '".$csp_prefix."''self'' ''unsafe-inline''".$csp_suffix."' ".
+                         " WHERE setting_id = 'csp_admin_style' ".
+                         " AND setting_ns = 'system' ".
+                         " AND setting_value = 'self'' ''unsafe-inline' ";
+               $core->con->execute($strReq);
+               $strReq = 'UPDATE '.$core->prefix.'setting '.
+                         " SET setting_value = '".$csp_prefix."''self'' data: media.dotaddict.org blob:' ".
+                         " WHERE setting_id = 'csp_admin_img' ".
+                         " AND setting_ns = 'system' ".
+                         " AND setting_value = 'self'' data: media.dotaddict.org' ";
+               $core->con->execute($strReq);
+
                # Update CSP img-src default directive
                $strReq = 'UPDATE '.$core->prefix.'setting '.
-                         " SET setting_value = '''self'' data: media.dotaddict.org blob:' ".
+                         " SET setting_value = '".$csp_prefix."''self'' data: media.dotaddict.org blob:' ".
                          " WHERE setting_id = 'csp_admin_img' ".
                          " AND setting_ns = 'system' ".