X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2FGigi.java;h=445fe365a2bda70e8408836251823e05653aa201;hb=28f6b558d8116f8cbb17390a83235976b50903b0;hp=3fa5d47a8313d86788f6c015830620d76cc33c0f;hpb=a47365418ded7c5e8df26c2e92b76b3118a23654;p=gigi.git

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 3fa5d47a..445fe365 100644
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -20,7 +20,6 @@ import org.cacert.gigi.email.EmailProvider;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
-import org.cacert.gigi.pages.PolicyRedir;
 import org.cacert.gigi.pages.TestSecure;
 import org.cacert.gigi.pages.Verify;
 import org.cacert.gigi.pages.account.MailAdd;
@@ -48,11 +47,10 @@ public class Gigi extends HttpServlet {
 		pages.put("/", new MainPage("CACert - Home"));
 		pages.put("/secure", new TestSecure());
 		pages.put(Verify.PATH, new Verify());
-		pages.put(AssurePage.PATH, new AssurePage());
+		pages.put(AssurePage.PATH + "/*", new AssurePage());
 		pages.put(MailCertificates.PATH, new MailCertificates());
 		pages.put(MyDetails.PATH, new MyDetails());
 		pages.put(RegisterPage.PATH, new RegisterPage());
-		pages.put(PolicyRedir.PATH, new PolicyRedir());
 		pages.put(MailOverview.DEFAULT_PATH, new MailOverview(
 				"My email addresses"));
 		pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email"));
@@ -61,7 +59,7 @@ public class Gigi extends HttpServlet {
 				new FileInputStream(new File("templates/base.html"))))) {
 			String tmp;
 			while ((tmp = reader.readLine()) != null) {
-				templ += tmp;
+				templ += tmp + "\n";
 			}
 			baseTemplate = templ.split("\\$content\\$");
 		} catch (Exception e) {
@@ -73,6 +71,11 @@ public class Gigi extends HttpServlet {
 	@Override
 	protected void service(HttpServletRequest req, HttpServletResponse resp)
 			throws ServletException, IOException {
+		addXSSHeaders(resp);
+		if (req.getHeader("Origin") != null) {
+			resp.getWriter().println("No cross domain access allowed.");
+			return;
+		}
 		HttpSession hs = req.getSession();
 		if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
 			if (hs != null) {
@@ -115,7 +118,7 @@ public class Gigi extends HttpServlet {
 
 	}
 	private Page getPage(String pathInfo) {
-		if (pathInfo.endsWith("/")) {
+		if (pathInfo.endsWith("/") && !pathInfo.equals("/")) {
 			pathInfo = pathInfo.substring(0, pathInfo.length() - 1);
 		}
 		Page page = pages.get(pathInfo);
@@ -142,5 +145,12 @@ public class Gigi extends HttpServlet {
 		in = in.replaceAll("\\$year\\$", year + "");
 		return in;
 	}
+	public static void addXSSHeaders(HttpServletResponse hsr) {
+		hsr.addHeader("Access-Control-Allow-Origin",
+				"http://cacert.org https://localhost");
+		hsr.addHeader("Access-Control-Max-Age", "60");
+		// hsr.addHeader("Content-Security-Policy",
+		// "default-src 'self'; report-uri https://felix.dogcraft.de/report.php");
 
+	}
 }