import org.cacert.gigi.pages.LoginPage;
import org.cacert.gigi.pages.MainPage;
import org.cacert.gigi.pages.Page;
-import org.cacert.gigi.pages.PolicyRedir;
import org.cacert.gigi.pages.TestSecure;
import org.cacert.gigi.pages.Verify;
import org.cacert.gigi.pages.account.MailAdd;
import org.cacert.gigi.pages.account.MyDetails;
import org.cacert.gigi.pages.main.RegisterPage;
import org.cacert.gigi.pages.wot.AssurePage;
+import org.cacert.gigi.util.ServerConstants;
import org.eclipse.jetty.util.log.Log;
public class Gigi extends HttpServlet {
pages.put("/", new MainPage("CACert - Home"));
pages.put("/secure", new TestSecure());
pages.put(Verify.PATH, new Verify());
- pages.put(AssurePage.PATH, new AssurePage());
+ pages.put(AssurePage.PATH + "/*", new AssurePage());
pages.put(MailCertificates.PATH, new MailCertificates());
pages.put(MyDetails.PATH, new MyDetails());
pages.put(RegisterPage.PATH, new RegisterPage());
- pages.put(PolicyRedir.PATH, new PolicyRedir());
pages.put(MailOverview.DEFAULT_PATH, new MailOverview(
"My email addresses"));
pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email"));
new FileInputStream(new File("templates/base.html"))))) {
String tmp;
while ((tmp = reader.readLine()) != null) {
- templ += tmp;
+ templ += tmp + "\n";
}
baseTemplate = templ.split("\\$content\\$");
} catch (Exception e) {
@Override
protected void service(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
+ addXSSHeaders(resp);
+ if (req.getHeader("Origin") != null) {
+ resp.getWriter().println("No cross domain access allowed.");
+ return;
+ }
HttpSession hs = req.getSession();
if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
if (hs != null) {
}
private Page getPage(String pathInfo) {
-
+ if (pathInfo.endsWith("/") && !pathInfo.equals("/")) {
+ pathInfo = pathInfo.substring(0, pathInfo.length() - 1);
+ }
Page page = pages.get(pathInfo);
if (page != null) {
return page;
in = in.replaceAll("\\$year\\$", year + "");
return in;
}
+ public static void addXSSHeaders(HttpServletResponse hsr) {
+ hsr.addHeader("Access-Control-Allow-Origin",
+ "http://cacert.org https://localhost");
+ hsr.addHeader("Access-Control-Max-Age", "60");
+ hsr.addHeader("Content-Security-Policy", "default-src 'self' https://"
+ + ServerConstants.getStaticHostNamePort()
+ + " https://www.cacert.org/*;frame-ancestors 'none'");
+ // ;report-uri https://felix.dogcraft.de/report.php
+ }
}