Merge pull request #523 from ljm42/master

CSP: block-all-mixed-content
2026-03-15 15:30:40 -05:00 · 2019-10-06 13:08:24 -07:00
parent 9ff83703ff a4b3da30df
commit 28daa551da
15 changed files with 47 additions and 6 deletions
--- a/logging.htm
+++ b/logging.htm
@@ -1,7 +1,8 @@
 <!DOCTYPE HTML>
-<html>
+<html lang="en">
 <head>
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <style>
@font-face{
 font-family:'clear-sans';font-weight:normal;font-style:normal;
--- a/login.php
+++ b/login.php
@@ -46,7 +46,8 @@ extract(parse_plugin_cfg('dynamix',true));
 $theme_dark = in_array($display['theme'],['black','gray']);
 ?>
 <!DOCTYPE html>
-<html lang="en"><head>
+<html lang="en">
+<head>
    <meta charset="utf-8">
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
    <meta http-equiv="Cache-Control" content="no-cache">
@@ -54,6 +55,8 @@ $theme_dark = in_array($display['theme'],['black','gray']);
    <meta http-equiv="Expires" content="0">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="robots" content="noindex, nofollow">
+    <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
    <title><?=$var['NAME']?>/Login</title>
    <style>
    /************************
--- a/plugins/dynamix.docker.manager/include/ContainerSize.php
+++ b/plugins/dynamix.docker.manager/include/ContainerSize.php
@@ -21,6 +21,7 @@ require_once "$docroot/webGui/include/Helpers.php";
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <meta http-equiv="X-UA-Compatible" content="IE=edge">
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/font-awesome.css")?>">
--- a/plugins/dynamix.docker.manager/log.htm
+++ b/plugins/dynamix.docker.manager/log.htm
@@ -1,7 +1,8 @@
 <!DOCTYPE HTML>
-<html>
+<html lang="en">
 <head>
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <style>
@font-face{
 font-family:'clear-sans';font-weight:normal;font-style:normal;
--- a/plugins/dynamix.plugin.manager/include/ShowChanges.php
+++ b/plugins/dynamix.plugin.manager/include/ShowChanges.php
@@ -16,9 +16,10 @@ require_once "$docroot/webGui/include/Markdown.php";
 require_once "$docroot/webGui/include/Helpers.php";
 ?>
 <!DOCTYPE HTML>
-<html>
+<html lang="en">
 <head>
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 </head>
--- a/plugins/dynamix/include/Boot.php
+++ b/plugins/dynamix/include/Boot.php
@@ -17,9 +17,10 @@ require_once "$docroot/webGui/include/Helpers.php";
 $var = parse_ini_file("/var/local/emhttp/var.ini");
 ?>
 <!DOCTYPE HTML>
-<html>
+<html lang="en">
 <head>
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov('/webGui/styles/default-fonts.css')?>">
 <style>
 html{font-family:clear-sans;font-size:62.5%;height:100%}
--- a/plugins/dynamix/include/CryptoBenchmark.php
+++ b/plugins/dynamix/include/CryptoBenchmark.php
@@ -26,6 +26,7 @@ $hash = trim(explode(':',$hash)[1]);
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <meta http-equiv="X-UA-Compatible" content="IE=edge">
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/font-awesome.css")?>">
--- a/plugins/dynamix/include/DefaultPageLayout.php
+++ b/plugins/dynamix/include/DefaultPageLayout.php
@@ -27,6 +27,7 @@ $themes2 = in_array($theme,['gray','azure']);
 <meta name="format-detection" content="telephone=no">
 <meta name="viewport" content="width=1440">
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="image/png" rel="shortcut icon" href="/webGui/images/<?=$var['mdColor']?>.png">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-cases.css")?>">
--- a/plugins/dynamix/include/Feedback.php
+++ b/plugins/dynamix/include/Feedback.php
@@ -26,6 +26,11 @@ if (array_key_exists('getdiagnostics', $_GET)) {
    exit;
 }
 ?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 <style>
@@ -40,6 +45,7 @@ textarea{width:100%;height:250px;margin:10px 0}
 input[type=button]{margin-right:0;float:right}
 input[type=email]{margin-top:8px;float:left}
 </style>
+</head>
 <body>
 <div style="margin-top:0;line-height:30px;margin-left:5px;margin-right:5px">
 <div id="control_panel" class="four">
@@ -198,3 +204,4 @@ $(function() {
 });
 </script>
 </body>
+</html>
--- a/plugins/dynamix/include/ParityHistory.php
+++ b/plugins/dynamix/include/ParityHistory.php
@@ -33,6 +33,7 @@ function his_duration($time) {
 <html lang="en">
 <head>
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 </head>
--- a/plugins/dynamix/include/ReplaceKey.php
+++ b/plugins/dynamix/include/ReplaceKey.php
@@ -16,6 +16,11 @@ require_once "$docroot/webGui/include/Helpers.php";
 $var = parse_ini_file('state/var.ini');
 $keyfile = base64_encode(file_get_contents($var['regFILE']));
 ?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 <script src="<?autov('/webGui/javascript/dynamix.js')?>"></script>
@@ -51,6 +56,7 @@ function replaceKey(email, guid, keyfile) {
  }
 }
 </script>
+</head>
 <body>
 <div style="margin-top:20px;line-height:30px;margin-left:40px">
 <div id="status_panel"></div>
@@ -67,3 +73,4 @@ Once a replacement key is generated, your old USB Flash device will be <b>blackl
 </form>
 </div>
 </body>
+</html>
--- a/plugins/dynamix/include/SelectCase.php
+++ b/plugins/dynamix/include/SelectCase.php
@@ -46,6 +46,7 @@ $casemodel = $exist ? file_get_contents("$boot/$file") : '';
 <meta name="format-detection" content="telephone=no">
 <meta name="viewport" content="width=1440">
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-cases.css")?>">
--- a/plugins/dynamix/include/SystemInformation.php
+++ b/plugins/dynamix/include/SystemInformation.php
@@ -31,6 +31,11 @@ function dmidecode($key,$n,$all=true) {
  return $all ? $properties : $properties[0];
 }
 ?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 <style>
@@ -56,6 +61,7 @@ function updateTime() {
  setTimeout(updateTime, 1000);
 }
 </script>
+</head>
 <body onLoad="updateTime()">
 <div class="box">
 <div><span class="key">Model:</span>
@@ -226,3 +232,4 @@ foreach ($sPorts as $port) {
 <?endif;?>
 </div></div>
 </body>
+</html>
--- a/plugins/dynamix/include/TrialRequest.php
+++ b/plugins/dynamix/include/TrialRequest.php
@@ -20,9 +20,15 @@ if (!empty($_POST['trial'])) {
  exit;
 }
 ?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-fonts.css")?>">
 <link type="text/css" rel="stylesheet" href="<?autov("/webGui/styles/default-popup.css")?>">
 <script src="<?autov('/webGui/javascript/dynamix.js')?>"></script>
+</head>
 <body>
 <div style="margin:20px;">
 <div id="status_panel"></div>
@@ -65,3 +71,4 @@ $('#eula').change(function() {
 });
 </script>
 </body>
+</html>
--- a/update.htm
+++ b/update.htm
@@ -1,7 +1,8 @@
 <!DOCTYPE HTML>
-<html>
+<html lang="en">
 <head>
 <meta name="robots" content="noindex, nofollow">
+<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
 <style>
@font-face{
 font-family:'clear-sans';font-weight:normal;font-style:normal;