Fixed allowFraming option
Ylian Saint-Hilaire committed
Oct 22, 2019 at 17:51 UTC
b30f3d60731a40ff6ea09c4211a9ac30f478b873
2 files changed
+12
-11
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.2-y",
3
+ "version": "0.4.2-z",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+11
-10
@@ -1494,7 +1494,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1494
if (obj.args.nousers == true) { features += 0x00000004; } // Single user mode
1495
if (domain.userQuota == -1) { features += 0x00000008; } // No server files mode
1496
if (obj.args.mpstlsoffload) { features += 0x00000010; } // No mutual-auth CIRA
1497
- if (parent.config.settings.allowframing == true) { features += 0x00000020; } // Allow site within iframe
1497
+ if ((parent.config.settings.allowframing == true) || (typeof parent.config.settings.allowframing == 'string')) { features += 0x00000020; } // Allow site within iframe
1498
if ((obj.parent.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.lanonly != true)) { features += 0x00000040; } // Email invites
1499
if (obj.args.webrtc == true) { features += 0x00000080; } // Enable WebRTC (Default false for now)
1500
if (obj.args.clickonce !== false) { features += 0x00000100; } // Enable ClickOnce (Default true)
@@ -1570,7 +1570,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1570
function handleRootRequestLogin(req, res, domain, hardwareKeyChallenge, passRequirements) {
1571
parent.debug('web', 'handleRootRequestLogin()');
1572
var features = 0;
1573
- if ((parent.config != null) && (parent.config.settings != null) && (parent.config.settings.allowframing == true)) { features += 32; } // Allow site within iframe
1573
+ if ((parent.config != null) && (parent.config.settings != null) && ((parent.config.settings.allowframing == true) || (typeof parent.config.settings.allowframing == 'string'))) { features += 32; } // Allow site within iframe
1574
if (domain.usernameisemail) { features += 0x00200000; } // Username is email address
1575
var httpsPort = ((obj.args.aliasport == null) ? obj.args.port : obj.args.aliasport); // Use HTTPS alias port is specified
1576
var loginmode = '';
@@ -3233,14 +3233,15 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3233
} else {
3234
// Use default security headers
3235
var geourl = (domain.geolocation ? ' *.openstreetmap.org' : '');
3236
- var selfurl = ((args.notls !== true) ? (" wss://" + req.headers.host) : (" ws://" + req.headers.host));
3237
- res.set({
3238
- "X-Frame-Options": "sameorigin",
3239
- "Referrer-Policy": "no-referrer",
3240
- "X-XSS-Protection": "1; mode=block",
3241
- "X-Content-Type-Options": "nosniff",
3242
- "Content-Security-Policy": "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'" + geourl + selfurl + "; img-src 'self'" + geourl + " data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"
3243
- });
3236
+ var selfurl = ((args.notls !== true) ? (' wss://' + req.headers.host) : (' ws://' + req.headers.host));
3237
+ var headers = {
3238
+ 'Referrer-Policy': 'no-referrer',
3239
+ 'X-XSS-Protection': '1; mode=block',
3240
+ 'X-Content-Type-Options': 'nosniff',
3241
+ 'Content-Security-Policy': "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'" + geourl + selfurl + "; img-src 'self'" + geourl + " data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"
3242
+ };
3243
+ if ((parent.config.settings.allowframing !== true) && (typeof parent.config.settings.allowframing !== 'string')) { headers['X-Frame-Options'] = 'sameorigin'; }
3244
+ res.set(headers);
3245
}
3246
3247
// Check the session if bound to the external IP address