Commit 0c9a9b5

committed

add nonce for Ubiquity JsUtils

1 parent db96c71 commit 0c9a9b5Copy full SHA for 0c9a9b5

File tree

+18

-21

lines changed

+18

-21

lines changed

Lines changed: 1 addition & 0 deletions

Lines changed: 0 additions & 21 deletions

Original file line number	Diff line number	Diff line change
`@@ -73,27 +73,10 @@ protected function minify($input) {`
`73`	`73`	`*/`
`74`	`74`	`protected function _open_script($src = '') {`
`75`	`75`	`$str = '<script ';`
`76`		`- if (! $this->isAjax() && isset($this->params['nonce'])) {`
`77`		`- $nonce = $this->nonce ?? $this->generateNonce($this->params['nonce']);`
`78`		`- $str .= ' nonce="' . $nonce . '" ';`
`79`		`- }`
`80`	`76`	`$str .= ($src == '') ? '>' : ' src="' . $src . '">';`
`81`	`77`	`return $str;`
`82`	`78`	`}`
`83`	`79`
`84`		`- protected function onNonce() {}`
`85`		`-`
`86`		`- protected function generateNonce($value = null): string {`
`87`		`- $bytes = \random_bytes((int) ($value ?? 32));`
`88`		`- $this->nonce = \base64_encode($bytes);`
`89`		`- $this->onNonce();`
`90`		`- return $this->nonce;`
`91`		`- }`
`92`		`-`
`93`		`- public function getNonce() {`
`94`		`- return $this->nonce;`
`95`		`- }`
`96`		`-`
`97`	`80`	`/**`
`98`	`81`	`* Outputs an closing </script>`
`99`	`82`	`*`
`@@ -111,8 +94,4 @@ protected function conflict() {`
`111`	`94`	`public function addToCompile($jsScript) {`
`112`	`95`	`$this->_addToCompile($jsScript);`
`113`	`96`	`}`
`114`		`-`
`115`		`- public function isAjax(): bool {`
`116`		`- return (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest');`
`117`		`- }`
`118`	`97`	`}`

Lines changed: 17 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -3,9 +3,26 @@`
`3`	`3`
`4`	`4`	`use Ubiquity\controllers\Startup;`
`5`	`5`	`use Ubiquity\utils\http\URequest;`
	`6`	`+use Ubiquity\security\csp\ContentSecurityManager;`
`6`	`7`
`7`	`8`	`class JsUtils extends \Ajax\JsUtils {`
`8`	`9`
	`10`	`+ /**`
	`11`	`+ * Outputs an opening <script>`
	`12`	`+ *`
	`13`	`+ * @param string $src`
	`14`	`+ * @return string`
	`15`	`+ */`
	`16`	`+ protected function _open_script($src = '') {`
	`17`	`+ $str = '<script ';`
	`18`	`+ if (isset($this->params['nonce']) && ContentSecurityManager::isStarted()) {`
	`19`	`+ $nonce = ContentSecurityManager::getNonce('jsUtils');`
	`20`	`+ $str .= ' nonce="' . $nonce . '" ';`
	`21`	`+ }`
	`22`	`+ $str .= ($src == '') ? '>' : ' src="' . $src . '">';`
	`23`	`+ return $str;`
	`24`	`+ }`
	`25`	`+`
`9`	`26`	`public function getUrl($url) {`
`10`	`27`	`return URequest::getUrl($url);`
`11`	`28`	`}`

Comments

(0)