Made HTTPS strict configurable.
Ylian Saint-Hilaire committed
Feb 14, 2019 at 15:53 UTC
6dd4ff69e986ab7be9665ddf456e235bfffc32ed
3 files changed
+6
-4
meshagent.js
+1
-1
@@ -385,7 +385,7 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
385
obj.db.Set(obj.common.escapeLinksFieldName(mesh));
386
obj.parent.meshes[obj.dbMeshKey] = mesh;
387
388
- if (adminUser.links == null) user.links = {};
388
+ if (adminUser.links == null) adminUser.links = {};
389
adminUser.links[obj.dbMeshKey] = { rights: 0xFFFFFFFF };
390
obj.db.SetUser(adminUser);
391
obj.parent.parent.DispatchEvent(['*', obj.dbMeshKey, adminUser._id], obj, { etype: 'mesh', username: adminUser.name, meshid: obj.dbMeshKey, name: meshname, mtype: 2, desc: '', action: 'createmesh', links: links, msg: 'Mesh created: ' + obj.meshid, domain: domain.id });
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.2.8-g",
3
+ "version": "0.2.8-i",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+4
-2
@@ -2211,8 +2211,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2211
// Default headers if TLS is used
2212
//headers = { 'Referrer-Policy': 'no-referrer', 'x-frame-options': 'SAMEORIGIN', 'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src https: wss: data: 'self';script-src https: 'unsafe-inline';style-src https: 'unsafe-inline'" };
2213
2214
- // Set Strict-Transport-Security if we are using a trusted certificate or TLS offload.
2215
- headers = { 'Strict-Transport-Security': 'max-age=31536000;includeSubDomains' };
2214
+ if (typeof obj.args.httpsstrict == 'number') {
2215
+ // Set Strict-Transport-Security if we are using a trusted certificate or TLS offload.
2216
+ headers = { 'Strict-Transport-Security': 'max-age=' + obj.args.httpsstrict + ';includeSubDomains' };
2217
+ }
2218
}
2219
if (parent.config.settings.accesscontrolalloworigin != null) { headers['Access-Control-Allow-Origin'] = parent.config.settings.accesscontrolalloworigin; }
2220
res.set(headers);