mirror of
https://github.com/EGroupware/egroupware.git
synced 2024-12-22 14:41:29 +01:00
move egw_framework::csp_*_source_attrs($attrs) to Api\Header\ContentSecurityPolicy::add(*-src, $attrs) and egw_ckeditor_config to Api\Html\CkEditorConfig
This commit is contained in:
Ralf Becker
parent
69a070498b
commit
99714aa9e9
164
api/src/Header/ContentSecurityPolicy.php
Normal file
164
api/src/Header/ContentSecurityPolicy.php
Normal file
@ -0,0 +1,164 @@
|
|||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* EGroupware API - Content Security Policy headers
|
||||||
|
*
|
||||||
|
* @link http://www.egroupware.org
|
||||||
|
* @author Ralf Becker <RalfBecker-AT-outdoor-training.de>
|
||||||
|
* @package api
|
||||||
|
* @subpackage header
|
||||||
|
* @access public
|
||||||
|
* @version $Id$
|
||||||
|
*/
|
||||||
|
|
||||||
|
namespace EGroupware\Api\Header;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Content Security Policy headers
|
||||||
|
*/
|
||||||
|
class ContentSecurityPolicy
|
||||||
|
{
|
||||||
|
/**
|
||||||
|
* Additional attributes or urls for CSP beside always added "self"
|
||||||
|
*
|
||||||
|
* - "script-src 'self' 'unsafe-eval'" allows only self and eval (eg. ckeditor), but forbids inline scripts, onchange, etc
|
||||||
|
* - "connect-src 'self'" allows ajax requests only to self
|
||||||
|
* - "style-src 'self' 'unsafe-inline'" allows only self and inline style, which we need
|
||||||
|
* - "frame-src 'self' manual.egroupware.org" allows frame and iframe content only for self or manual.egroupware.org
|
||||||
|
*
|
||||||
|
* @var array
|
||||||
|
*/
|
||||||
|
private static $sources = array(
|
||||||
|
'script-src' => array("'unsafe-eval'"),
|
||||||
|
'style-src' => array("'unsafe-inline'"),
|
||||||
|
'connect-src' => array(),
|
||||||
|
'frame-src' => null, // NOT array(), to allow setting no default frame-src!
|
||||||
|
);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Add Content-Security-Policy sources
|
||||||
|
*
|
||||||
|
* Calling this method with an empty array for frame-src, sets no defaults but "'self'"!
|
||||||
|
*
|
||||||
|
* @param string|array $set =array() URL (incl. protocol!)
|
||||||
|
* @param string $source valid CSP source types like 'script-src', 'style-src', 'connect-src', 'frame-src', ...
|
||||||
|
* @param string|array $attrs 'unsafe-eval' and/or 'unsafe-inline' (without quotes!) or URL (incl. protocol!)
|
||||||
|
*/
|
||||||
|
public static function add($source, $attrs)
|
||||||
|
{
|
||||||
|
if (!isset(self::$sources[$source]))
|
||||||
|
{
|
||||||
|
// set frame-src attrs of API and apps via hook
|
||||||
|
if ($source == 'frame-src' && !isset($attrs))
|
||||||
|
{
|
||||||
|
$attrs = array('manual.egroupware.org', 'www.egroupware.org');
|
||||||
|
if (($app_additional = $GLOBALS['egw']->hooks->process('csp-frame-src')))
|
||||||
|
{
|
||||||
|
foreach($app_additional as $addtional)
|
||||||
|
{
|
||||||
|
if ($addtional) $attrs = array_unique(array_merge($attrs, $addtional));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
self::$sources[$source] = array();
|
||||||
|
}
|
||||||
|
foreach((array)$attrs as $attr)
|
||||||
|
{
|
||||||
|
if (in_array($attr, array('none', 'self', 'unsafe-eval', 'unsafe-inline')))
|
||||||
|
{
|
||||||
|
$attr = "'$attr'"; // automatic add quotes
|
||||||
|
}
|
||||||
|
if (!in_array($attr, self::$sources[$source]))
|
||||||
|
{
|
||||||
|
self::$sources[$source][] = $attr;
|
||||||
|
//error_log(__METHOD__."() setting CSP script-src $attr ".function_backtrace());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set Content-Security-Policy attributes for script-src: 'unsafe-eval' and/or 'unsafe-inline'
|
||||||
|
*
|
||||||
|
* Using CK-Editor currently requires both to be set :(
|
||||||
|
*
|
||||||
|
* Old pre-et2 apps might need to call Api\Headers::script_src_attrs(array('unsafe-eval','unsafe-inline'))
|
||||||
|
*
|
||||||
|
* EGroupware itself currently still requires 'unsafe-eval'!
|
||||||
|
*
|
||||||
|
* @param string|array $set =array() 'unsafe-eval' and/or 'unsafe-inline' (without quotes!) or URL (incl. protocol!)
|
||||||
|
*/
|
||||||
|
public static function add_script_src($set=null)
|
||||||
|
{
|
||||||
|
self::add('script-src', $set);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set Content-Security-Policy attributes for style-src: 'unsafe-inline'
|
||||||
|
*
|
||||||
|
* EGroupware itself currently still requires 'unsafe-inline'!
|
||||||
|
*
|
||||||
|
* @param string|array $set =array() 'unsafe-inline' (without quotes!) and/or URL (incl. protocol!)
|
||||||
|
*/
|
||||||
|
public static function add_style_src($set=null)
|
||||||
|
{
|
||||||
|
self::add('style-src', $set);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set Content-Security-Policy attributes for connect-src:
|
||||||
|
*
|
||||||
|
* @param string|array $set =array() URL (incl. protocol!)
|
||||||
|
*/
|
||||||
|
public static function add_connect_src($set=null)
|
||||||
|
{
|
||||||
|
self::add('connect-src', $set);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set/get Content-Security-Policy attributes for frame-src:
|
||||||
|
*
|
||||||
|
* Calling this method with an empty array sets no frame-src, but "'self'"!
|
||||||
|
*
|
||||||
|
* @param string|array $set =array() URL (incl. protocol!)
|
||||||
|
* @return string with attributes eg. "'unsafe-inline'"
|
||||||
|
*/
|
||||||
|
public static function add_frame_src($set=null)
|
||||||
|
{
|
||||||
|
self::add('frame-src', $set);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Send Content-Security-Policy header
|
||||||
|
*
|
||||||
|
* @link http://content-security-policy.com/
|
||||||
|
*/
|
||||||
|
public static function send()
|
||||||
|
{
|
||||||
|
self::add('frame-src', null); // set defaults for frame-src
|
||||||
|
|
||||||
|
$policies = array();
|
||||||
|
foreach(self::$sources as $source => $urls)
|
||||||
|
{
|
||||||
|
$policies[] = "$source 'self' ".implode(' ', $urls);
|
||||||
|
}
|
||||||
|
$csp = implode('; ', $policies);
|
||||||
|
|
||||||
|
//$csp = "default-src * 'unsafe-eval' 'unsafe-inline'"; // allow everything
|
||||||
|
|
||||||
|
$user_agent = UserAgent::type();
|
||||||
|
$version = UserAgent::version();
|
||||||
|
|
||||||
|
// recommendaton ist to not send regular AND deprecated headers together, as they can cause unexpected behavior
|
||||||
|
if ($user_agent == 'chrome' && $version < 25 || $user_agent == 'safari' && $version < 7)
|
||||||
|
{
|
||||||
|
header("X-Webkit-CSP: $csp"); // Chrome: <= 24, Safari incl. iOS
|
||||||
|
}
|
||||||
|
elseif ($user_agent == 'firefox' && $version < 23 || $user_agent == 'msie') // Edge is reported as 'edge'!
|
||||||
|
{
|
||||||
|
header("X-Content-Security-Policy: $csp");
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
header("Content-Security-Policy: $csp");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -50,7 +50,7 @@ class UserAgent
|
|||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* user-agent: 'firefox', 'msie', 'safari' (incl. iPhone), 'chrome', 'opera', 'konqueror', 'mozilla'
|
* user-agent: 'firefox', 'msie', 'edge', 'safari' (incl. iPhone), 'chrome', 'opera', 'konqueror', 'mozilla'
|
||||||
*
|
*
|
||||||
* @var string
|
* @var string
|
||||||
*/
|
*/
|
||||||
|
|||||||
@ -16,7 +16,6 @@ namespace EGroupware\Api;
|
|||||||
|
|
||||||
// explicitly import classes not yet imported into Api
|
// explicitly import classes not yet imported into Api
|
||||||
use egw_framework; // validate_file, includeCSS
|
use egw_framework; // validate_file, includeCSS
|
||||||
use egw_ckeditor_config;
|
|
||||||
use egw; // link
|
use egw; // link
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -437,7 +436,7 @@ class Html
|
|||||||
|
|
||||||
// User preferences
|
// User preferences
|
||||||
$font = $GLOBALS['egw_info']['user']['preferences']['common']['rte_font'];
|
$font = $GLOBALS['egw_info']['user']['preferences']['common']['rte_font'];
|
||||||
$font_size = egw_ckeditor_config::font_size_from_prefs();
|
$font_size = Html\CkEditorConfing::font_size_from_prefs();
|
||||||
$font_span = '<span '.($font||$font_size?'style=\"':'').($font?'font-family:'.$font.'; ':'').($font_size?'font-size:'.$font_size.'; ':'').'\">';
|
$font_span = '<span '.($font||$font_size?'style=\"':'').($font?'font-family:'.$font.'; ':'').($font_size?'font-size:'.$font_size.'; ':'').'\">';
|
||||||
if (empty($font) && empty($font_size)) $font_span = '';
|
if (empty($font) && empty($font_size)) $font_span = '';
|
||||||
|
|
||||||
@ -449,7 +448,7 @@ class Html
|
|||||||
<script type="text/javascript">
|
<script type="text/javascript">
|
||||||
window.CKEDITOR_BASEPATH="'.$GLOBALS['egw_info']['server']['webserver_url'].'/phpgwapi/js/ckeditor/";
|
window.CKEDITOR_BASEPATH="'.$GLOBALS['egw_info']['server']['webserver_url'].'/phpgwapi/js/ckeditor/";
|
||||||
egw_LAB.wait(function() {
|
egw_LAB.wait(function() {
|
||||||
CKEDITOR.replace("'.$_name.'", '.egw_ckeditor_config::get_ckeditor_config($_mode,
|
CKEDITOR.replace("'.$_name.'", '.Html\CkEditorConfing::get_ckeditor_config($_mode,
|
||||||
$pxheight, $expanded, $_start_path).');
|
$pxheight, $expanded, $_start_path).');
|
||||||
CKEDITOR.addCss("body { margin: 5px; }");
|
CKEDITOR.addCss("body { margin: 5px; }");
|
||||||
CKEDITOR.instances["'.$_name.'"].on(
|
CKEDITOR.instances["'.$_name.'"].on(
|
||||||
|
|||||||
518
api/src/Html/CkEditorConfig.php
Normal file
518
api/src/Html/CkEditorConfig.php
Normal file
@ -0,0 +1,518 @@
|
|||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* EGroupware - Class which generates JSON encoded configuration for the ckeditor
|
||||||
|
*
|
||||||
|
* @link http://www.egroupware.org
|
||||||
|
* @author RalfBecker-AT-outdoor-training.de
|
||||||
|
* @author Andreas Stoeckel <as-AT-stylite.de>
|
||||||
|
* @package api
|
||||||
|
* @subpackage html
|
||||||
|
* @license http://opensource.org/licenses/gpl-license.php GPL - GNU General Public License
|
||||||
|
* @version $Id$
|
||||||
|
*/
|
||||||
|
|
||||||
|
namespace EGroupware\Api\Html;
|
||||||
|
|
||||||
|
use EGroupware\Api\Header\ContentSecurityPolicy;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* CK-Editor configuration
|
||||||
|
*/
|
||||||
|
class CkEditorConfig
|
||||||
|
{
|
||||||
|
private static $lang = null;
|
||||||
|
private static $country = null;
|
||||||
|
private static $enterMode = null;
|
||||||
|
private static $skin = null;
|
||||||
|
|
||||||
|
// Defaults, defined in phpgwapi/js/ckeditor/plugins/font/plugin.js
|
||||||
|
public static $font_options = array(
|
||||||
|
'arial, helvetica, sans-serif' => 'Arial',
|
||||||
|
'Comic Sans MS, cursive' => 'Comic Sans MS',
|
||||||
|
'Courier New, Courier, monospace' => 'Courier New',
|
||||||
|
'Georgia, serif' => 'Georgia',
|
||||||
|
'Lucida Sans Unicode, Lucida Grande, sans-serif' => 'Lucida Sans Unicode',
|
||||||
|
'Tahoma, Geneva, sans-serif' => 'Tahoma',
|
||||||
|
'times new roman, times, serif' => 'Times New Roman',
|
||||||
|
'Trebuchet MS, Helvetica, sans-serif' => 'Trebuchet MS',
|
||||||
|
'Verdana, Geneva, sans-serif' => 'Verdana'
|
||||||
|
);
|
||||||
|
public static $font_size_options = array(
|
||||||
|
8 => '8',
|
||||||
|
9 => '9',
|
||||||
|
10 => '10',
|
||||||
|
11 => '11',
|
||||||
|
12 => '12',
|
||||||
|
14 => '14',
|
||||||
|
16 => '16',
|
||||||
|
18 => '18',
|
||||||
|
20 => '20',
|
||||||
|
22 => '22',
|
||||||
|
24 => '24',
|
||||||
|
26 => '26',
|
||||||
|
28 => '28',
|
||||||
|
36 => '36',
|
||||||
|
48 => '48',
|
||||||
|
72 => '72',
|
||||||
|
);
|
||||||
|
public static $font_unit_options = array(
|
||||||
|
'pt' => 'pt: points (1/72 inch)',
|
||||||
|
'px' => 'px: display pixels',
|
||||||
|
);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Get available CKEditor Skins
|
||||||
|
*
|
||||||
|
* Only return skins existing in filesystem, as we disable / remove them if not compatible with supported browsers.
|
||||||
|
*
|
||||||
|
* @return array skin => label pairs alphabetical sorted with default moono first
|
||||||
|
*/
|
||||||
|
public static function getAvailableCKEditorSkins()
|
||||||
|
{
|
||||||
|
$labels = array(
|
||||||
|
'kama' => lang('kama theme'),
|
||||||
|
'moono' => lang('moono theme (default)'),
|
||||||
|
'moonocolor' => lang('moono color theme'),
|
||||||
|
'moono-dark' => lang('dark moono theme'),
|
||||||
|
'Moono_blue' => lang('blue moono theme'),
|
||||||
|
'bootstrapck' => lang('bootstrap theme for ckeditor'),
|
||||||
|
'icy_orange' => lang('icy-orange theme for ckeditor'),
|
||||||
|
'office2013' => lang('office-2013 theme for ckeditor'),
|
||||||
|
'minimalist' => lang('Minimalist theme'),
|
||||||
|
'flat' => lang('Flat theme')
|
||||||
|
);
|
||||||
|
$skins = array();
|
||||||
|
|
||||||
|
foreach(scandir(EGW_SERVER_ROOT.'/phpgwapi/js/ckeditor/skins') as $skin)
|
||||||
|
{
|
||||||
|
if ($skin[0] == '.') continue;
|
||||||
|
|
||||||
|
if (isset($labels[$skin]))
|
||||||
|
{
|
||||||
|
$skins[$skin] = $labels[$skin];
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
$skins[$skin] = str_replace('_', '-', $skin).' '.lang('Theme');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
uasort($skins, 'strcasecmp');
|
||||||
|
|
||||||
|
// return our default "moono" first
|
||||||
|
return isset($skins['moono']) ? array('moono' => $skins['moono'])+$skins : $skins;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Get font size from preferences
|
||||||
|
*
|
||||||
|
* @param array $prefs =null default $GLOBALS['egw_info']['user']['preferences']
|
||||||
|
* @param string &$size =null on return just size, without unit
|
||||||
|
* @param string &$unit =null on return just unit
|
||||||
|
* @return string font-size including unit
|
||||||
|
*/
|
||||||
|
public static function font_size_from_prefs(array $prefs=null, &$size=null, &$unit=null)
|
||||||
|
{
|
||||||
|
if (is_null($prefs)) $prefs = $GLOBALS['egw_info']['user']['preferences'];
|
||||||
|
|
||||||
|
$size = $prefs['common']['rte_font_size'];
|
||||||
|
$unit = $prefs['common']['rte_font_unit'];
|
||||||
|
if (substr($size, -2) == 'px')
|
||||||
|
{
|
||||||
|
$unit = 'px';
|
||||||
|
$size = (string)(int)$size;
|
||||||
|
}
|
||||||
|
return $size.($size?$unit:'');
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Read language and country settings for the ckeditor and store them in static
|
||||||
|
* variables
|
||||||
|
*/
|
||||||
|
private static function read_lang_country()
|
||||||
|
{
|
||||||
|
//use the lang and country information to construct a possible lang info for CKEditor UI and scayt_slang
|
||||||
|
self::$lang = ($GLOBALS['egw_info']['user']['preferences']['common']['spellchecker_lang'] ?
|
||||||
|
$GLOBALS['egw_info']['user']['preferences']['common']['spellchecker_lang']:
|
||||||
|
$GLOBALS['egw_info']['user']['preferences']['common']['lang']);
|
||||||
|
|
||||||
|
self::$country = $GLOBALS['egw_info']['user']['preferences']['common']['country'];
|
||||||
|
|
||||||
|
if (!(strpos(self::$lang, '-')===false))
|
||||||
|
list(self::$lang, self::$country) = explode('-', self::$lang);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns the current user language
|
||||||
|
*/
|
||||||
|
private static function get_lang()
|
||||||
|
{
|
||||||
|
if (self::$lang == null || self::$country == null)
|
||||||
|
self::read_lang_country();
|
||||||
|
|
||||||
|
return self::$lang;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns the current user country
|
||||||
|
*/
|
||||||
|
private static function get_country()
|
||||||
|
{
|
||||||
|
if (self::$lang == null || self::$country == null)
|
||||||
|
self::read_lang_country();
|
||||||
|
|
||||||
|
return strtoupper(self::$country);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns the ckeditor basepath
|
||||||
|
*/
|
||||||
|
private static function get_base_path()
|
||||||
|
{
|
||||||
|
//Get the ckeditor base url
|
||||||
|
return $GLOBALS['egw_info']['server']['webserver_url'].'/phpgwapi/js/ckeditor/';
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns the ckeditor enter mode which defaults to "BR"
|
||||||
|
*/
|
||||||
|
private static function get_enter_mode()
|
||||||
|
{
|
||||||
|
if (self::$enterMode == null)
|
||||||
|
{
|
||||||
|
//Get the input name
|
||||||
|
$enterMode = 2;
|
||||||
|
if (isset($GLOBALS['egw_info']['user']['preferences']['common']['rte_enter_mode']))
|
||||||
|
{
|
||||||
|
switch ($GLOBALS['egw_info']['user']['preferences']['common']['rte_enter_mode'])
|
||||||
|
{
|
||||||
|
case 'p':
|
||||||
|
$enterMode = 1;
|
||||||
|
break;
|
||||||
|
case 'br':
|
||||||
|
$enterMode = 2;
|
||||||
|
break;
|
||||||
|
case 'div':
|
||||||
|
$enterMode = 3;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
self::$enterMode = $enterMode;
|
||||||
|
}
|
||||||
|
|
||||||
|
return self::$enterMode;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns the skin the ckeditor should use
|
||||||
|
*/
|
||||||
|
private static function get_skin()
|
||||||
|
{
|
||||||
|
if (self::$skin == null)
|
||||||
|
{
|
||||||
|
//Get the skin name
|
||||||
|
$skin = $GLOBALS['egw_info']['user']['preferences']['common']['rte_skin'];
|
||||||
|
//error_log(__METHOD__.__LINE__.' UserAgent:'.html::$user_agent);
|
||||||
|
//Convert old fckeditor skin names to new ones
|
||||||
|
switch ($skin)
|
||||||
|
{
|
||||||
|
case 'kama':
|
||||||
|
$skin = "kama";
|
||||||
|
//if (html::$user_agent=='firefox' || html::$user_agent=='msie') $skin='moonocolor';
|
||||||
|
break;
|
||||||
|
case 'silver':
|
||||||
|
case 'moono-dark':
|
||||||
|
$skin = "moono-dark";
|
||||||
|
break;
|
||||||
|
case 'icy_orange':
|
||||||
|
$skin = "icy_orange";
|
||||||
|
break;
|
||||||
|
case 'bootstrapck': // no longer support by egw
|
||||||
|
case 'Moono_blue':
|
||||||
|
case 'office2013':
|
||||||
|
case 'office2003':
|
||||||
|
case 'moonocolor':
|
||||||
|
$skin = "moonocolor";
|
||||||
|
break;
|
||||||
|
case 'minimalist':
|
||||||
|
$skin = "minimalist";
|
||||||
|
break;
|
||||||
|
case 'flat':
|
||||||
|
$skin = "flat";
|
||||||
|
break;
|
||||||
|
case 'moono':
|
||||||
|
case 'default':
|
||||||
|
default:
|
||||||
|
$skin = "moono";
|
||||||
|
}
|
||||||
|
|
||||||
|
//Check whether the skin actually exists, if not, switch to a default
|
||||||
|
if (!file_exists(EGW_SERVER_ROOT.'/phpgwapi/js/ckeditor/skins/'.$skin))
|
||||||
|
{
|
||||||
|
$skin = "moono"; //this is the basic skin for ckeditor
|
||||||
|
}
|
||||||
|
self::$skin = $skin;
|
||||||
|
}
|
||||||
|
|
||||||
|
return self::$skin;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns the URL of the filebrowser
|
||||||
|
*
|
||||||
|
* @param string $start_path start path for file browser
|
||||||
|
*/
|
||||||
|
private static function get_filebrowserBrowseUrl($start_path = '')
|
||||||
|
{
|
||||||
|
return $GLOBALS['egw_info']['server']['webserver_url'].'/index.php?menuaction=filemanager.filemanager_select.select&mode=open&method=ckeditor_return'
|
||||||
|
.($start_path != '' ? '&path='.$start_path : '');
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Adds all "easy to write" options to the configuration
|
||||||
|
*
|
||||||
|
* @param array& $config array were config get's added to
|
||||||
|
* @param int|string $height integer height in pixel or string with css unit
|
||||||
|
* @param boolean|string $expanded_toolbar show toolbar expanded, boolean value, string "false", or string casted to boolean
|
||||||
|
* @param string $start_path start path for file browser
|
||||||
|
*/
|
||||||
|
private static function add_default_options(&$config, $height, $expanded_toolbar, $start_path)
|
||||||
|
{
|
||||||
|
//Convert the pixel height to an integer value
|
||||||
|
$config['resize_enabled'] = false;
|
||||||
|
$config['height'] = is_numeric($height) ? (int)$height : $height;
|
||||||
|
//disable encoding as entities needs to set the config value to false, as the default is true with the current ckeditor version
|
||||||
|
$config['entities'] = false;
|
||||||
|
$config['entities_latin'] = false;
|
||||||
|
$config['editingBlock'] = true;
|
||||||
|
$config['disableNativeSpellChecker'] = true;
|
||||||
|
// we set allowedContent to true as the 4.1 contentFiltering system allows only activated features as content
|
||||||
|
$config['allowedContent'] = true;
|
||||||
|
|
||||||
|
$config['removePlugins'] = 'elementspath';
|
||||||
|
|
||||||
|
$config['toolbarCanCollapse'] = true;
|
||||||
|
$config['toolbarStartupExpanded'] = is_bool($expanded_toolbar) ? $expanded_toolbar :
|
||||||
|
($expanded_toolbar === 'false' ? false : (boolean)$expanded_toolbar);
|
||||||
|
|
||||||
|
$config['filebrowserBrowseUrl'] = self::get_filebrowserBrowseUrl($start_path);
|
||||||
|
$config['filebrowserWindowHeight'] = 640;
|
||||||
|
$config['filebrowserWindowWidth'] = 580;
|
||||||
|
|
||||||
|
$config['language'] = self::get_lang();
|
||||||
|
$config['enterMode'] = self::get_enter_mode();
|
||||||
|
$config['skin'] = self::get_skin();
|
||||||
|
|
||||||
|
$config['fontSize_sizes'] = '';
|
||||||
|
$unit = $GLOBALS['egw_info']['user']['preferences']['common']['rte_font_unit'];
|
||||||
|
if (empty($unit)) $unit = 'px';
|
||||||
|
foreach(self::$font_size_options as $k => $v)
|
||||||
|
{
|
||||||
|
$config['fontSize_sizes'] .= $v.$unit.'/'.$k.$unit.';';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Adds the spellchecker configuration to the options and writes the name of
|
||||||
|
* the spellchecker toolbar button to the "spellchecker_button" parameter
|
||||||
|
*/
|
||||||
|
private static function add_spellchecker_options(&$config, &$spellchecker_button, &$scayt_button)
|
||||||
|
{
|
||||||
|
//error_log(__METHOD__.__LINE__.' Spellcheck:'.$GLOBALS['egw_info']['server']['enabled_spellcheck']);
|
||||||
|
if (isset($GLOBALS['egw_info']['server']['enabled_spellcheck']) && $GLOBALS['egw_info']['server']['enabled_spellcheck'])
|
||||||
|
{
|
||||||
|
// enable browsers native spellchecker as default, if e.g.: aspell fails
|
||||||
|
// to use browsers native spellchecker, you have to hold CMD/CTRL button on rightclick to
|
||||||
|
// access the browsers spell correction options
|
||||||
|
if ($GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesNoSCAYT') $config['disableNativeSpellChecker'] = false;
|
||||||
|
|
||||||
|
if (!empty($GLOBALS['egw_info']['server']['aspell_path']) &&
|
||||||
|
is_executable($GLOBALS['egw_info']['server']['aspell_path']) &&
|
||||||
|
($GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesUseWebSpellCheck' &&
|
||||||
|
$GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesBrowserBased')
|
||||||
|
)
|
||||||
|
{
|
||||||
|
$spellchecker_button = 'SpellCheck';
|
||||||
|
self::append_extraPlugins_config_array($config, array("aspell"));
|
||||||
|
}
|
||||||
|
if ($GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesNoSCAYT' &&
|
||||||
|
$GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesBrowserBased'
|
||||||
|
)
|
||||||
|
{
|
||||||
|
$scayt_button='Scayt';
|
||||||
|
$config['scayt_autoStartup'] = true;
|
||||||
|
$config['scayt_sLang'] = self::get_lang().'_'.self::get_country();
|
||||||
|
$config['disableNativeSpellChecker'] = true; // only one spell as you type
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
$config['scayt_autoStartup'] = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Writes the toolbar configuration to the options which depends on the chosen
|
||||||
|
* mode and the spellchecker_button written by the add_spellchecker_options button
|
||||||
|
*/
|
||||||
|
private static function add_toolbar_options(&$config, $mode, $spellchecker_button, $scayt_button=false)
|
||||||
|
{
|
||||||
|
$config['toolbar'] = array();
|
||||||
|
switch ($mode)
|
||||||
|
{
|
||||||
|
case 'advanced':
|
||||||
|
$config['toolbar'][] = array('name' => 'document', 'items' => array('Source','DocProps','-','Preview','-','Templates'));
|
||||||
|
$config['toolbar'][] = array('name' => 'clipboard', 'items' => array('Cut','Copy','Paste','PasteText','PasteFromWord','-','Print'));
|
||||||
|
if ($spellchecker_button||$scayt_button)
|
||||||
|
{
|
||||||
|
$configArray = array();
|
||||||
|
if ($spellchecker_button) $configArray[] = $spellchecker_button;
|
||||||
|
if ($scayt_button) $configArray[] = $scayt_button;
|
||||||
|
$config['toolbar'][] = array('name' => 'tools', 'items' => $configArray);
|
||||||
|
}
|
||||||
|
$config['toolbar'][] = array('name' => 'edit', 'items' => array('Undo','Redo','-','Find','Replace','-','SelectAll','RemoveFormat'));
|
||||||
|
|
||||||
|
$config['toolbar'][] = '/';
|
||||||
|
|
||||||
|
$config['toolbar'][] = array('name' => 'basicstyles', 'items' => array('Bold','Italic','Underline','Strike','-','Subscript','Superscript'));
|
||||||
|
$config['toolbar'][] = array('name' => 'justify', 'items' => array('JustifyLeft','JustifyCenter','JustifyRight','JustifyBlock'));
|
||||||
|
$config['toolbar'][] = array('name' => 'paragraph', 'items' => array('BulletedList','NumberedList','-','Outdent','Indent'));
|
||||||
|
$config['toolbar'][] = array('name' => 'links', 'items' => array('Link','Unlink','Anchor'));
|
||||||
|
$config['toolbar'][] = array('name' => 'insert', 'items' => array('Maximize','Image','Table','HorizontalRule','SpecialChar'/*,'Smiley'*/));
|
||||||
|
|
||||||
|
$config['toolbar'][] = '/';
|
||||||
|
|
||||||
|
$config['toolbar'][] = array('name' => 'styles', 'items' => array('Style','Format','Font','FontSize'));
|
||||||
|
$config['toolbar'][] = array('name' => 'colors', 'items' => array('TextColor','BGColor'));
|
||||||
|
$config['toolbar'][] = array('name' => 'tools', 'items' => array('ShowBlocks','-','About'));
|
||||||
|
break;
|
||||||
|
|
||||||
|
case 'extended': default:
|
||||||
|
$config['toolbar'][] = array('name' => 'clipboard', 'items' => array('Bold','Italic','Underline'));
|
||||||
|
$config['toolbar'][] = array('name' => 'justify', 'items' => array('JustifyLeft','JustifyCenter','JustifyRight','JustifyBlock'));
|
||||||
|
$config['toolbar'][] = array('name' => 'paragraph', 'items' => array('BulletedList','NumberedList'/*,'Smiley'*/,'Outdent','Indent','Undo','Redo'));
|
||||||
|
$config['toolbar'][] = array('name' => 'clipboard', 'items' => array('Cut','Copy','Paste','PasteText','PasteFromWord','-','Print'));
|
||||||
|
|
||||||
|
if ($mode == 'extended')
|
||||||
|
{
|
||||||
|
$config['toolbar'][] = array('name' => 'insert', 'items' => array('Image','Link','Unlink','Anchor'));
|
||||||
|
if ($spellchecker_button||$scayt_button)
|
||||||
|
{
|
||||||
|
$configArray = array('Maximize');
|
||||||
|
if ($spellchecker_button) $configArray[] = $spellchecker_button;
|
||||||
|
if ($scayt_button) $configArray[] = $scayt_button;
|
||||||
|
$config['toolbar'][] = array('name' => 'tools', 'items' => $configArray);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
$config['toolbar'][] = array('name' => 'insert', 'items' => array('Maximize'));//, 'Image', 'Table');
|
||||||
|
|
||||||
|
$config['toolbar'][count($config['toolbar']) - 1][] = array('name' => 'insert', 'items' => array('Image', 'Table'));
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if ($spellchecker_button||$scayt_button)
|
||||||
|
{
|
||||||
|
$configArray = array('Maximize');
|
||||||
|
if ($spellchecker_button) $configArray[] = $spellchecker_button;
|
||||||
|
if ($scayt_button) $configArray[] = $scayt_button;
|
||||||
|
$config['toolbar'][] = array('name' => 'tools', 'items' => $configArray);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
$config['toolbar'][] = array('name' => 'tools', 'items' => array('Maximize'));
|
||||||
|
}
|
||||||
|
|
||||||
|
$config['toolbar'][] = '/';
|
||||||
|
$config['toolbar'][] = array('name' => 'edit', 'items' => array('Find','Replace','-','SelectAll','RemoveFormat'));
|
||||||
|
if ($mode == 'simple-withimage') $config['toolbar'][] = array('name' => 'links', 'items' => array('Image','Link','Unlink'));
|
||||||
|
$config['toolbar'][] = array('name' => 'styles', 'items' => array('Format','Font','FontSize'));
|
||||||
|
$config['toolbar'][] = array('name' => 'colors', 'items' => array('TextColor','BGColor'));
|
||||||
|
$config['toolbar'][] = array('name' => 'tools', 'items' => array('ShowBlocks','-','About'));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @see get_ckeditor_config
|
||||||
|
*/
|
||||||
|
public static function get_ckeditor_config_array($mode = '', $height = 400, $expanded_toolbar = true, $start_path = '')
|
||||||
|
{
|
||||||
|
// set for CK-Editor necessary CSP script-src attributes
|
||||||
|
self::set_csp_script_src_attrs();
|
||||||
|
|
||||||
|
// If not explicitly set, use preference for toolbar mode
|
||||||
|
if(!$mode || trim($mode) == '') $mode = $GLOBALS['egw_info']['user']['preferences']['common']['rte_features'];
|
||||||
|
$config = array();
|
||||||
|
$spellchecker_button = null;
|
||||||
|
|
||||||
|
self::add_default_options($config, $height, $expanded_toolbar, $start_path);
|
||||||
|
$scayt_button = null;
|
||||||
|
self::add_spellchecker_options($config, $spellchecker_button, $scayt_button);
|
||||||
|
self::add_toolbar_options($config, $mode, $spellchecker_button, $scayt_button);
|
||||||
|
//error_log(__METHOD__."('$mode', $height, ".array2string($expanded_toolbar).") returning ".array2string($config));
|
||||||
|
// Add extra plugins
|
||||||
|
self::append_extraPlugins_config_array($config, array('uploadimage','uploadwidget','widget','notification','notificationaggregator','lineutils'));
|
||||||
|
return $config;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Adds extra
|
||||||
|
* @param array $config
|
||||||
|
* @param array $plugins plugins name which needs to be appended into extraPlugins
|
||||||
|
*/
|
||||||
|
public static function append_extraPlugins_config_array (&$config, $plugins)
|
||||||
|
{
|
||||||
|
if (is_array($plugins))
|
||||||
|
{
|
||||||
|
foreach ($plugins as &$plugin)
|
||||||
|
{
|
||||||
|
if (!empty($config['extraPlugins']) && $config['extraPlugins'] !== '')
|
||||||
|
{
|
||||||
|
$config['extraPlugins'] .= ',' . $plugin;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
$config['extraPlugins'] = $plugin;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns a json encoded string containing the configuration for the ckeditor.
|
||||||
|
* @param string $mode specifies the count of toolbar buttons available to the user. Possible
|
||||||
|
* values are 'simple', 'extended' and 'advanced'. All other values will default to 'simple'
|
||||||
|
* @param integer $height contains the height of the ckeditor in pixels
|
||||||
|
* @param boolean $expanded_toolbar specifies whether the ckeditor should start with an expanded toolbar or not
|
||||||
|
* @param string $start_path specifies
|
||||||
|
*/
|
||||||
|
public static function get_ckeditor_config($mode = '', $height = 400, $expanded_toolbar = true, $start_path = '')
|
||||||
|
{
|
||||||
|
return json_encode(self::get_ckeditor_config_array($mode, $height, $expanded_toolbar, $start_path));
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* URL webspellchecker uses for scripts and style-sheets
|
||||||
|
*/
|
||||||
|
const WEBSPELLCHECK_HOST = 'svc.webspellchecker.net';
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set for CK-Editor necessary CSP script-src attributes
|
||||||
|
*
|
||||||
|
* Get's called automatic from get_ckeditor_config(_array)
|
||||||
|
*/
|
||||||
|
public static function set_csp_script_src_attrs()
|
||||||
|
{
|
||||||
|
$attrs = array('unsafe-eval', 'unsafe-inline');
|
||||||
|
$url = ($_SERVER['HTTPS'] ? 'https://' : 'http://').self::WEBSPELLCHECK_HOST;
|
||||||
|
|
||||||
|
// if webspellchecker is enabled in EGroupware config, allow access to it's url
|
||||||
|
if (in_array($GLOBALS['egw_info']['server']['enabled_spellcheck'], array('True', 'YesUseWebSpellCheck')))
|
||||||
|
{
|
||||||
|
$attrs[] = $url;
|
||||||
|
|
||||||
|
ContentSecurityPolicy::add('style-src', $url);
|
||||||
|
}
|
||||||
|
//error_log(__METHOD__."() egw_info[server][enabled_spellcheck]='{$GLOBALS['egw_info']['server']['enabled_spellcheck']}' --> attrs=".array2string($attrs));
|
||||||
|
// tell framework CK Editor needs eval and inline javascript :(
|
||||||
|
ContentSecurityPolicy::add('script-src', $attrs);
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -11,504 +11,9 @@
|
|||||||
* @version $Id$
|
* @version $Id$
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
use EGroupware\Api;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* CK-Editor configuration
|
* CK-Editor configuration
|
||||||
*/
|
*/
|
||||||
class egw_ckeditor_config
|
class egw_ckeditor_config extends Api\Html\CkEditorConfig{}
|
||||||
{
|
|
||||||
private static $lang = null;
|
|
||||||
private static $country = null;
|
|
||||||
private static $enterMode = null;
|
|
||||||
private static $skin = null;
|
|
||||||
|
|
||||||
// Defaults, defined in phpgwapi/js/ckeditor/plugins/font/plugin.js
|
|
||||||
public static $font_options = array(
|
|
||||||
'arial, helvetica, sans-serif' => 'Arial',
|
|
||||||
'Comic Sans MS, cursive' => 'Comic Sans MS',
|
|
||||||
'Courier New, Courier, monospace' => 'Courier New',
|
|
||||||
'Georgia, serif' => 'Georgia',
|
|
||||||
'Lucida Sans Unicode, Lucida Grande, sans-serif' => 'Lucida Sans Unicode',
|
|
||||||
'Tahoma, Geneva, sans-serif' => 'Tahoma',
|
|
||||||
'times new roman, times, serif' => 'Times New Roman',
|
|
||||||
'Trebuchet MS, Helvetica, sans-serif' => 'Trebuchet MS',
|
|
||||||
'Verdana, Geneva, sans-serif' => 'Verdana'
|
|
||||||
);
|
|
||||||
public static $font_size_options = array(
|
|
||||||
8 => '8',
|
|
||||||
9 => '9',
|
|
||||||
10 => '10',
|
|
||||||
11 => '11',
|
|
||||||
12 => '12',
|
|
||||||
14 => '14',
|
|
||||||
16 => '16',
|
|
||||||
18 => '18',
|
|
||||||
20 => '20',
|
|
||||||
22 => '22',
|
|
||||||
24 => '24',
|
|
||||||
26 => '26',
|
|
||||||
28 => '28',
|
|
||||||
36 => '36',
|
|
||||||
48 => '48',
|
|
||||||
72 => '72',
|
|
||||||
);
|
|
||||||
public static $font_unit_options = array(
|
|
||||||
'pt' => 'pt: points (1/72 inch)',
|
|
||||||
'px' => 'px: display pixels',
|
|
||||||
);
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Get available CKEditor Skins
|
|
||||||
*
|
|
||||||
* Only return skins existing in filesystem, as we disable / remove them if not compatible with supported browsers.
|
|
||||||
*
|
|
||||||
* @return array skin => label pairs alphabetical sorted with default moono first
|
|
||||||
*/
|
|
||||||
public static function getAvailableCKEditorSkins()
|
|
||||||
{
|
|
||||||
$labels = array(
|
|
||||||
'kama' => lang('kama theme'),
|
|
||||||
'moono' => lang('moono theme (default)'),
|
|
||||||
'moonocolor' => lang('moono color theme'),
|
|
||||||
'moono-dark' => lang('dark moono theme'),
|
|
||||||
'Moono_blue' => lang('blue moono theme'),
|
|
||||||
'bootstrapck' => lang('bootstrap theme for ckeditor'),
|
|
||||||
'icy_orange' => lang('icy-orange theme for ckeditor'),
|
|
||||||
'office2013' => lang('office-2013 theme for ckeditor'),
|
|
||||||
'minimalist' => lang('Minimalist theme'),
|
|
||||||
'flat' => lang('Flat theme')
|
|
||||||
);
|
|
||||||
$skins = array();
|
|
||||||
|
|
||||||
foreach(scandir(EGW_SERVER_ROOT.'/phpgwapi/js/ckeditor/skins') as $skin)
|
|
||||||
{
|
|
||||||
if ($skin[0] == '.') continue;
|
|
||||||
|
|
||||||
if (isset($labels[$skin]))
|
|
||||||
{
|
|
||||||
$skins[$skin] = $labels[$skin];
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$skins[$skin] = str_replace('_', '-', $skin).' '.lang('Theme');
|
|
||||||
}
|
|
||||||
}
|
|
||||||
uasort($skins, 'strcasecmp');
|
|
||||||
|
|
||||||
// return our default "moono" first
|
|
||||||
return isset($skins['moono']) ? array('moono' => $skins['moono'])+$skins : $skins;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Get font size from preferences
|
|
||||||
*
|
|
||||||
* @param array $prefs =null default $GLOBALS['egw_info']['user']['preferences']
|
|
||||||
* @param string &$size =null on return just size, without unit
|
|
||||||
* @param string &$unit =null on return just unit
|
|
||||||
* @return string font-size including unit
|
|
||||||
*/
|
|
||||||
public static function font_size_from_prefs(array $prefs=null, &$size=null, &$unit=null)
|
|
||||||
{
|
|
||||||
if (is_null($prefs)) $prefs = $GLOBALS['egw_info']['user']['preferences'];
|
|
||||||
|
|
||||||
$size = $prefs['common']['rte_font_size'];
|
|
||||||
$unit = $prefs['common']['rte_font_unit'];
|
|
||||||
if (substr($size, -2) == 'px')
|
|
||||||
{
|
|
||||||
$unit = 'px';
|
|
||||||
$size = (string)(int)$size;
|
|
||||||
}
|
|
||||||
return $size.($size?$unit:'');
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Read language and country settings for the ckeditor and store them in static
|
|
||||||
* variables
|
|
||||||
*/
|
|
||||||
private static function read_lang_country()
|
|
||||||
{
|
|
||||||
//use the lang and country information to construct a possible lang info for CKEditor UI and scayt_slang
|
|
||||||
self::$lang = ($GLOBALS['egw_info']['user']['preferences']['common']['spellchecker_lang'] ?
|
|
||||||
$GLOBALS['egw_info']['user']['preferences']['common']['spellchecker_lang']:
|
|
||||||
$GLOBALS['egw_info']['user']['preferences']['common']['lang']);
|
|
||||||
|
|
||||||
self::$country = $GLOBALS['egw_info']['user']['preferences']['common']['country'];
|
|
||||||
|
|
||||||
if (!(strpos(self::$lang, '-')===false))
|
|
||||||
list(self::$lang, self::$country) = explode('-', self::$lang);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the current user language
|
|
||||||
*/
|
|
||||||
private static function get_lang()
|
|
||||||
{
|
|
||||||
if (self::$lang == null || self::$country == null)
|
|
||||||
self::read_lang_country();
|
|
||||||
|
|
||||||
return self::$lang;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the current user country
|
|
||||||
*/
|
|
||||||
private static function get_country()
|
|
||||||
{
|
|
||||||
if (self::$lang == null || self::$country == null)
|
|
||||||
self::read_lang_country();
|
|
||||||
|
|
||||||
return strtoupper(self::$country);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the ckeditor basepath
|
|
||||||
*/
|
|
||||||
private static function get_base_path()
|
|
||||||
{
|
|
||||||
//Get the ckeditor base url
|
|
||||||
return $GLOBALS['egw_info']['server']['webserver_url'].'/phpgwapi/js/ckeditor/';
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the ckeditor enter mode which defaults to "BR"
|
|
||||||
*/
|
|
||||||
private static function get_enter_mode()
|
|
||||||
{
|
|
||||||
if (self::$enterMode == null)
|
|
||||||
{
|
|
||||||
//Get the input name
|
|
||||||
$enterMode = 2;
|
|
||||||
if (isset($GLOBALS['egw_info']['user']['preferences']['common']['rte_enter_mode']))
|
|
||||||
{
|
|
||||||
switch ($GLOBALS['egw_info']['user']['preferences']['common']['rte_enter_mode'])
|
|
||||||
{
|
|
||||||
case 'p':
|
|
||||||
$enterMode = 1;
|
|
||||||
break;
|
|
||||||
case 'br':
|
|
||||||
$enterMode = 2;
|
|
||||||
break;
|
|
||||||
case 'div':
|
|
||||||
$enterMode = 3;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
self::$enterMode = $enterMode;
|
|
||||||
}
|
|
||||||
|
|
||||||
return self::$enterMode;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the skin the ckeditor should use
|
|
||||||
*/
|
|
||||||
private static function get_skin()
|
|
||||||
{
|
|
||||||
if (self::$skin == null)
|
|
||||||
{
|
|
||||||
//Get the skin name
|
|
||||||
$skin = $GLOBALS['egw_info']['user']['preferences']['common']['rte_skin'];
|
|
||||||
//error_log(__METHOD__.__LINE__.' UserAgent:'.html::$user_agent);
|
|
||||||
//Convert old fckeditor skin names to new ones
|
|
||||||
switch ($skin)
|
|
||||||
{
|
|
||||||
case 'kama':
|
|
||||||
$skin = "kama";
|
|
||||||
//if (html::$user_agent=='firefox' || html::$user_agent=='msie') $skin='moonocolor';
|
|
||||||
break;
|
|
||||||
case 'silver':
|
|
||||||
case 'moono-dark':
|
|
||||||
$skin = "moono-dark";
|
|
||||||
break;
|
|
||||||
case 'icy_orange':
|
|
||||||
$skin = "icy_orange";
|
|
||||||
break;
|
|
||||||
case 'bootstrapck': // no longer support by egw
|
|
||||||
case 'Moono_blue':
|
|
||||||
case 'office2013':
|
|
||||||
case 'office2003':
|
|
||||||
case 'moonocolor':
|
|
||||||
$skin = "moonocolor";
|
|
||||||
break;
|
|
||||||
case 'minimalist':
|
|
||||||
$skin = "minimalist";
|
|
||||||
break;
|
|
||||||
case 'flat':
|
|
||||||
$skin = "flat";
|
|
||||||
break;
|
|
||||||
case 'moono':
|
|
||||||
case 'default':
|
|
||||||
default:
|
|
||||||
$skin = "moono";
|
|
||||||
}
|
|
||||||
|
|
||||||
//Check whether the skin actually exists, if not, switch to a default
|
|
||||||
if (!file_exists(EGW_SERVER_ROOT.'/phpgwapi/js/ckeditor/skins/'.$skin))
|
|
||||||
{
|
|
||||||
$skin = "moono"; //this is the basic skin for ckeditor
|
|
||||||
}
|
|
||||||
self::$skin = $skin;
|
|
||||||
}
|
|
||||||
|
|
||||||
return self::$skin;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the URL of the filebrowser
|
|
||||||
*
|
|
||||||
* @param string $start_path start path for file browser
|
|
||||||
*/
|
|
||||||
private static function get_filebrowserBrowseUrl($start_path = '')
|
|
||||||
{
|
|
||||||
return $GLOBALS['egw_info']['server']['webserver_url'].'/index.php?menuaction=filemanager.filemanager_select.select&mode=open&method=ckeditor_return'
|
|
||||||
.($start_path != '' ? '&path='.$start_path : '');
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Adds all "easy to write" options to the configuration
|
|
||||||
*
|
|
||||||
* @param array& $config array were config get's added to
|
|
||||||
* @param int|string $height integer height in pixel or string with css unit
|
|
||||||
* @param boolean|string $expanded_toolbar show toolbar expanded, boolean value, string "false", or string casted to boolean
|
|
||||||
* @param string $start_path start path for file browser
|
|
||||||
*/
|
|
||||||
private static function add_default_options(&$config, $height, $expanded_toolbar, $start_path)
|
|
||||||
{
|
|
||||||
//Convert the pixel height to an integer value
|
|
||||||
$config['resize_enabled'] = false;
|
|
||||||
$config['height'] = is_numeric($height) ? (int)$height : $height;
|
|
||||||
//disable encoding as entities needs to set the config value to false, as the default is true with the current ckeditor version
|
|
||||||
$config['entities'] = false;
|
|
||||||
$config['entities_latin'] = false;
|
|
||||||
$config['editingBlock'] = true;
|
|
||||||
$config['disableNativeSpellChecker'] = true;
|
|
||||||
// we set allowedContent to true as the 4.1 contentFiltering system allows only activated features as content
|
|
||||||
$config['allowedContent'] = true;
|
|
||||||
|
|
||||||
$config['removePlugins'] = 'elementspath';
|
|
||||||
|
|
||||||
$config['toolbarCanCollapse'] = true;
|
|
||||||
$config['toolbarStartupExpanded'] = is_bool($expanded_toolbar) ? $expanded_toolbar :
|
|
||||||
($expanded_toolbar === 'false' ? false : (boolean)$expanded_toolbar);
|
|
||||||
|
|
||||||
$config['filebrowserBrowseUrl'] = self::get_filebrowserBrowseUrl($start_path);
|
|
||||||
$config['filebrowserWindowHeight'] = 640;
|
|
||||||
$config['filebrowserWindowWidth'] = 580;
|
|
||||||
|
|
||||||
$config['language'] = self::get_lang();
|
|
||||||
$config['enterMode'] = self::get_enter_mode();
|
|
||||||
$config['skin'] = self::get_skin();
|
|
||||||
|
|
||||||
$config['fontSize_sizes'] = '';
|
|
||||||
$unit = $GLOBALS['egw_info']['user']['preferences']['common']['rte_font_unit'];
|
|
||||||
if (empty($unit)) $unit = 'px';
|
|
||||||
foreach(self::$font_size_options as $k => $v)
|
|
||||||
{
|
|
||||||
$config['fontSize_sizes'] .= $v.$unit.'/'.$k.$unit.';';
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Adds the spellchecker configuration to the options and writes the name of
|
|
||||||
* the spellchecker toolbar button to the "spellchecker_button" parameter
|
|
||||||
*/
|
|
||||||
private static function add_spellchecker_options(&$config, &$spellchecker_button, &$scayt_button)
|
|
||||||
{
|
|
||||||
//error_log(__METHOD__.__LINE__.' Spellcheck:'.$GLOBALS['egw_info']['server']['enabled_spellcheck']);
|
|
||||||
if (isset($GLOBALS['egw_info']['server']['enabled_spellcheck']) && $GLOBALS['egw_info']['server']['enabled_spellcheck'])
|
|
||||||
{
|
|
||||||
// enable browsers native spellchecker as default, if e.g.: aspell fails
|
|
||||||
// to use browsers native spellchecker, you have to hold CMD/CTRL button on rightclick to
|
|
||||||
// access the browsers spell correction options
|
|
||||||
if ($GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesNoSCAYT') $config['disableNativeSpellChecker'] = false;
|
|
||||||
|
|
||||||
if (!empty($GLOBALS['egw_info']['server']['aspell_path']) &&
|
|
||||||
is_executable($GLOBALS['egw_info']['server']['aspell_path']) &&
|
|
||||||
($GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesUseWebSpellCheck' &&
|
|
||||||
$GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesBrowserBased')
|
|
||||||
)
|
|
||||||
{
|
|
||||||
$spellchecker_button = 'SpellCheck';
|
|
||||||
self::append_extraPlugins_config_array($config, array("aspell"));
|
|
||||||
}
|
|
||||||
if ($GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesNoSCAYT' &&
|
|
||||||
$GLOBALS['egw_info']['server']['enabled_spellcheck']!='YesBrowserBased'
|
|
||||||
)
|
|
||||||
{
|
|
||||||
$scayt_button='Scayt';
|
|
||||||
$config['scayt_autoStartup'] = true;
|
|
||||||
$config['scayt_sLang'] = self::get_lang().'_'.self::get_country();
|
|
||||||
$config['disableNativeSpellChecker'] = true; // only one spell as you type
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$config['scayt_autoStartup'] = false;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Writes the toolbar configuration to the options which depends on the chosen
|
|
||||||
* mode and the spellchecker_button written by the add_spellchecker_options button
|
|
||||||
*/
|
|
||||||
private static function add_toolbar_options(&$config, $mode, $spellchecker_button, $scayt_button=false)
|
|
||||||
{
|
|
||||||
$config['toolbar'] = array();
|
|
||||||
switch ($mode)
|
|
||||||
{
|
|
||||||
case 'advanced':
|
|
||||||
$config['toolbar'][] = array('name' => 'document', 'items' => array('Source','DocProps','-','Preview','-','Templates'));
|
|
||||||
$config['toolbar'][] = array('name' => 'clipboard', 'items' => array('Cut','Copy','Paste','PasteText','PasteFromWord','-','Print'));
|
|
||||||
if ($spellchecker_button||$scayt_button)
|
|
||||||
{
|
|
||||||
$configArray = array();
|
|
||||||
if ($spellchecker_button) $configArray[] = $spellchecker_button;
|
|
||||||
if ($scayt_button) $configArray[] = $scayt_button;
|
|
||||||
$config['toolbar'][] = array('name' => 'tools', 'items' => $configArray);
|
|
||||||
}
|
|
||||||
$config['toolbar'][] = array('name' => 'edit', 'items' => array('Undo','Redo','-','Find','Replace','-','SelectAll','RemoveFormat'));
|
|
||||||
|
|
||||||
$config['toolbar'][] = '/';
|
|
||||||
|
|
||||||
$config['toolbar'][] = array('name' => 'basicstyles', 'items' => array('Bold','Italic','Underline','Strike','-','Subscript','Superscript'));
|
|
||||||
$config['toolbar'][] = array('name' => 'justify', 'items' => array('JustifyLeft','JustifyCenter','JustifyRight','JustifyBlock'));
|
|
||||||
$config['toolbar'][] = array('name' => 'paragraph', 'items' => array('BulletedList','NumberedList','-','Outdent','Indent'));
|
|
||||||
$config['toolbar'][] = array('name' => 'links', 'items' => array('Link','Unlink','Anchor'));
|
|
||||||
$config['toolbar'][] = array('name' => 'insert', 'items' => array('Maximize','Image','Table','HorizontalRule','SpecialChar'/*,'Smiley'*/));
|
|
||||||
|
|
||||||
$config['toolbar'][] = '/';
|
|
||||||
|
|
||||||
$config['toolbar'][] = array('name' => 'styles', 'items' => array('Style','Format','Font','FontSize'));
|
|
||||||
$config['toolbar'][] = array('name' => 'colors', 'items' => array('TextColor','BGColor'));
|
|
||||||
$config['toolbar'][] = array('name' => 'tools', 'items' => array('ShowBlocks','-','About'));
|
|
||||||
break;
|
|
||||||
|
|
||||||
case 'extended': default:
|
|
||||||
$config['toolbar'][] = array('name' => 'clipboard', 'items' => array('Bold','Italic','Underline'));
|
|
||||||
$config['toolbar'][] = array('name' => 'justify', 'items' => array('JustifyLeft','JustifyCenter','JustifyRight','JustifyBlock'));
|
|
||||||
$config['toolbar'][] = array('name' => 'paragraph', 'items' => array('BulletedList','NumberedList'/*,'Smiley'*/,'Outdent','Indent','Undo','Redo'));
|
|
||||||
$config['toolbar'][] = array('name' => 'clipboard', 'items' => array('Cut','Copy','Paste','PasteText','PasteFromWord','-','Print'));
|
|
||||||
|
|
||||||
if ($mode == 'extended')
|
|
||||||
{
|
|
||||||
$config['toolbar'][] = array('name' => 'insert', 'items' => array('Image','Link','Unlink','Anchor'));
|
|
||||||
if ($spellchecker_button||$scayt_button)
|
|
||||||
{
|
|
||||||
$configArray = array('Maximize');
|
|
||||||
if ($spellchecker_button) $configArray[] = $spellchecker_button;
|
|
||||||
if ($scayt_button) $configArray[] = $scayt_button;
|
|
||||||
$config['toolbar'][] = array('name' => 'tools', 'items' => $configArray);
|
|
||||||
}
|
|
||||||
else
|
|
||||||
$config['toolbar'][] = array('name' => 'insert', 'items' => array('Maximize'));//, 'Image', 'Table');
|
|
||||||
|
|
||||||
$config['toolbar'][count($config['toolbar']) - 1][] = array('name' => 'insert', 'items' => array('Image', 'Table'));
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
if ($spellchecker_button||$scayt_button)
|
|
||||||
{
|
|
||||||
$configArray = array('Maximize');
|
|
||||||
if ($spellchecker_button) $configArray[] = $spellchecker_button;
|
|
||||||
if ($scayt_button) $configArray[] = $scayt_button;
|
|
||||||
$config['toolbar'][] = array('name' => 'tools', 'items' => $configArray);
|
|
||||||
}
|
|
||||||
else
|
|
||||||
$config['toolbar'][] = array('name' => 'tools', 'items' => array('Maximize'));
|
|
||||||
}
|
|
||||||
|
|
||||||
$config['toolbar'][] = '/';
|
|
||||||
$config['toolbar'][] = array('name' => 'edit', 'items' => array('Find','Replace','-','SelectAll','RemoveFormat'));
|
|
||||||
if ($mode == 'simple-withimage') $config['toolbar'][] = array('name' => 'links', 'items' => array('Image','Link','Unlink'));
|
|
||||||
$config['toolbar'][] = array('name' => 'styles', 'items' => array('Format','Font','FontSize'));
|
|
||||||
$config['toolbar'][] = array('name' => 'colors', 'items' => array('TextColor','BGColor'));
|
|
||||||
$config['toolbar'][] = array('name' => 'tools', 'items' => array('ShowBlocks','-','About'));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @see get_ckeditor_config
|
|
||||||
*/
|
|
||||||
public static function get_ckeditor_config_array($mode = '', $height = 400, $expanded_toolbar = true, $start_path = '')
|
|
||||||
{
|
|
||||||
// set for CK-Editor necessary CSP script-src attributes
|
|
||||||
self::set_csp_script_src_attrs();
|
|
||||||
|
|
||||||
// If not explicitly set, use preference for toolbar mode
|
|
||||||
if(!$mode || trim($mode) == '') $mode = $GLOBALS['egw_info']['user']['preferences']['common']['rte_features'];
|
|
||||||
$config = array();
|
|
||||||
$spellchecker_button = null;
|
|
||||||
|
|
||||||
self::add_default_options($config, $height, $expanded_toolbar, $start_path);
|
|
||||||
$scayt_button = null;
|
|
||||||
self::add_spellchecker_options($config, $spellchecker_button, $scayt_button);
|
|
||||||
self::add_toolbar_options($config, $mode, $spellchecker_button, $scayt_button);
|
|
||||||
//error_log(__METHOD__."('$mode', $height, ".array2string($expanded_toolbar).") returning ".array2string($config));
|
|
||||||
// Add extra plugins
|
|
||||||
self::append_extraPlugins_config_array($config, array('uploadimage','uploadwidget','widget','notification','notificationaggregator','lineutils'));
|
|
||||||
return $config;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Adds extra
|
|
||||||
* @param array $config
|
|
||||||
* @param array $plugins plugins name which needs to be appended into extraPlugins
|
|
||||||
*/
|
|
||||||
public static function append_extraPlugins_config_array (&$config, $plugins)
|
|
||||||
{
|
|
||||||
if (is_array($plugins))
|
|
||||||
{
|
|
||||||
foreach ($plugins as &$plugin)
|
|
||||||
{
|
|
||||||
if (!empty($config['extraPlugins']) && $config['extraPlugins'] !== '')
|
|
||||||
{
|
|
||||||
$config['extraPlugins'] .= ',' . $plugin;
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$config['extraPlugins'] = $plugin;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns a json encoded string containing the configuration for the ckeditor.
|
|
||||||
* @param string $mode specifies the count of toolbar buttons available to the user. Possible
|
|
||||||
* values are 'simple', 'extended' and 'advanced'. All other values will default to 'simple'
|
|
||||||
* @param integer $height contains the height of the ckeditor in pixels
|
|
||||||
* @param boolean $expanded_toolbar specifies whether the ckeditor should start with an expanded toolbar or not
|
|
||||||
* @param string $start_path specifies
|
|
||||||
*/
|
|
||||||
public static function get_ckeditor_config($mode = '', $height = 400, $expanded_toolbar = true, $start_path = '')
|
|
||||||
{
|
|
||||||
return json_encode(self::get_ckeditor_config_array($mode, $height, $expanded_toolbar, $start_path));
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* URL webspellchecker uses for scripts and style-sheets
|
|
||||||
*/
|
|
||||||
const WEBSPELLCHECK_HOST = 'svc.webspellchecker.net';
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Set for CK-Editor necessary CSP script-src attributes
|
|
||||||
*
|
|
||||||
* Get's called automatic from get_ckeditor_config(_array)
|
|
||||||
*/
|
|
||||||
public static function set_csp_script_src_attrs()
|
|
||||||
{
|
|
||||||
$attrs = array('unsafe-eval', 'unsafe-inline');
|
|
||||||
$url = ($_SERVER['HTTPS'] ? 'https://' : 'http://').self::WEBSPELLCHECK_HOST;
|
|
||||||
|
|
||||||
// if webspellchecker is enabled in EGroupware config, allow access to it's url
|
|
||||||
if (in_array($GLOBALS['egw_info']['server']['enabled_spellcheck'], array('True', 'YesUseWebSpellCheck')))
|
|
||||||
{
|
|
||||||
$attrs[] = $url;
|
|
||||||
|
|
||||||
egw_framework::csp_style_src_attrs($url);
|
|
||||||
}
|
|
||||||
//error_log(__METHOD__."() egw_info[server][enabled_spellcheck]='{$GLOBALS['egw_info']['server']['enabled_spellcheck']}' --> attrs=".array2string($attrs));
|
|
||||||
// tell framework CK Editor needs eval and inline javascript :(
|
|
||||||
egw_framework::csp_script_src_attrs($attrs);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|||||||
@ -12,6 +12,8 @@
|
|||||||
* @version $Id$
|
* @version $Id$
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
use EGroupware\Api;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* eGW API - framework: virtual base class for all template sets
|
* eGW API - framework: virtual base class for all template sets
|
||||||
*
|
*
|
||||||
@ -127,15 +129,6 @@ abstract class egw_framework
|
|||||||
return new $class($GLOBALS['egw_info']['server']['template_set']);
|
return new $class($GLOBALS['egw_info']['server']['template_set']);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Additional attributes or urls for CSP script-src 'self'
|
|
||||||
*
|
|
||||||
* 'unsafe-eval' is currently allways added, as it is used in a couple of places.
|
|
||||||
*
|
|
||||||
* @var array
|
|
||||||
*/
|
|
||||||
private static $csp_script_src_attrs = array("'unsafe-eval'");
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Set/get Content-Security-Policy attributes for script-src: 'unsafe-eval' and/or 'unsafe-inline'
|
* Set/get Content-Security-Policy attributes for script-src: 'unsafe-eval' and/or 'unsafe-inline'
|
||||||
*
|
*
|
||||||
@ -145,132 +138,49 @@ abstract class egw_framework
|
|||||||
*
|
*
|
||||||
* EGroupware itself currently still requires 'unsafe-eval'!
|
* EGroupware itself currently still requires 'unsafe-eval'!
|
||||||
*
|
*
|
||||||
* @param string|array $set =array() 'unsafe-eval' and/or 'unsafe-inline' (without quotes!) or URL (incl. protocol!)
|
* @param string|array $set =null 'unsafe-eval' and/or 'unsafe-inline' (without quotes!) or URL (incl. protocol!)
|
||||||
* @return string with attributes eg. "'unsafe-eval' 'unsafe-inline'"
|
* @deprecated use Api\Header\ContentSecurityPolicy::add('script-src', $set);
|
||||||
*/
|
*/
|
||||||
public static function csp_script_src_attrs($set=null)
|
public static function csp_script_src_attrs($set=null)
|
||||||
{
|
{
|
||||||
foreach((array)$set as $attr)
|
Api\Header\ContentSecurityPolicy::add('script-src', $set);
|
||||||
{
|
|
||||||
if (in_array($attr, array('none', 'self', 'unsafe-eval', 'unsafe-inline')))
|
|
||||||
{
|
|
||||||
$attr = "'$attr'"; // automatic add quotes
|
|
||||||
}
|
|
||||||
if (!in_array($attr, self::$csp_script_src_attrs))
|
|
||||||
{
|
|
||||||
self::$csp_script_src_attrs[] = $attr;
|
|
||||||
//error_log(__METHOD__."() setting CSP script-src $attr ".function_backtrace());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
//error_log(__METHOD__."(".array2string($set).") returned ".array2string(implode(' ', self::$csp_script_src_attrs)).' '.function_backtrace());
|
|
||||||
return implode(' ', self::$csp_script_src_attrs);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Additional attributes or urls for CSP style-src 'self'
|
|
||||||
*
|
|
||||||
* 'unsafe-inline' is currently allways added, as it is used in a couple of places.
|
|
||||||
*
|
|
||||||
* @var array
|
|
||||||
*/
|
|
||||||
private static $csp_style_src_attrs = array("'unsafe-inline'");
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Set/get Content-Security-Policy attributes for style-src: 'unsafe-inline'
|
* Set/get Content-Security-Policy attributes for style-src: 'unsafe-inline'
|
||||||
*
|
*
|
||||||
* EGroupware itself currently still requires 'unsafe-inline'!
|
* EGroupware itself currently still requires 'unsafe-inline'!
|
||||||
*
|
*
|
||||||
* @param string|array $set =array() 'unsafe-inline' (without quotes!) and/or URL (incl. protocol!)
|
* @param string|array $set =null 'unsafe-inline' (without quotes!) and/or URL (incl. protocol!)
|
||||||
* @return string with attributes eg. "'unsafe-inline'"
|
* @deprecated use Api\Header\ContentSecurityPolicy::add('style-src', $set);
|
||||||
*/
|
*/
|
||||||
public static function csp_style_src_attrs($set=null)
|
public static function csp_style_src_attrs($set=null)
|
||||||
{
|
{
|
||||||
foreach((array)$set as $attr)
|
Api\Header\ContentSecurityPolicy::add('style-src', $set);
|
||||||
{
|
|
||||||
if (in_array($attr, array('none', 'self', 'unsafe-inline')))
|
|
||||||
{
|
|
||||||
$attr = "'$attr'"; // automatic add quotes
|
|
||||||
}
|
|
||||||
if (!in_array($attr, self::$csp_style_src_attrs))
|
|
||||||
{
|
|
||||||
self::$csp_style_src_attrs[] = $attr;
|
|
||||||
//error_log(__METHOD__."() setting CSP script-src $attr ".function_backtrace());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
//error_log(__METHOD__."(".array2string($set).") returned ".array2string(implode(' ', self::$csp_script_src_attrs)).' '.function_backtrace());
|
|
||||||
return implode(' ', self::$csp_style_src_attrs);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Additional attributes or urls for CSP connect-src 'self'
|
|
||||||
*
|
|
||||||
* @var array
|
|
||||||
*/
|
|
||||||
private static $csp_connect_src_attrs = array();
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Set/get Content-Security-Policy attributes for connect-src:
|
* Set/get Content-Security-Policy attributes for connect-src:
|
||||||
*
|
*
|
||||||
* @param string|array $set =array() URL (incl. protocol!)
|
* @param string|array $set =array() URL (incl. protocol!)
|
||||||
* @return string with attributes eg. "'unsafe-inline'"
|
* @deprecated use Api\Header\ContentSecurityPolicy::add('connect-src', $set);
|
||||||
*/
|
*/
|
||||||
public static function csp_connect_src_attrs($set=null)
|
public static function csp_connect_src_attrs($set=null)
|
||||||
{
|
{
|
||||||
foreach((array)$set as $attr)
|
Api\Header\ContentSecurityPolicy::add('connect-src', $set);
|
||||||
{
|
|
||||||
if (!in_array($attr, self::$csp_connect_src_attrs))
|
|
||||||
{
|
|
||||||
self::$csp_connect_src_attrs[] = $attr;
|
|
||||||
//error_log(__METHOD__."() setting CSP script-src $attr ".function_backtrace());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
//error_log(__METHOD__."(".array2string($set).") returned ".array2string(implode(' ', self::$csp_connect_src_attrs)).' '.function_backtrace());
|
|
||||||
return implode(' ', self::$csp_connect_src_attrs);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Additional attributes or urls for CSP frame-src 'self'
|
|
||||||
*
|
|
||||||
* @var array
|
|
||||||
*/
|
|
||||||
private static $csp_frame_src_attrs;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Set/get Content-Security-Policy attributes for frame-src:
|
* Set/get Content-Security-Policy attributes for frame-src:
|
||||||
*
|
*
|
||||||
* Calling this method with an empty array sets no frame-src, but "'self'"!
|
* Calling this method with an empty array sets no frame-src, but "'self'"!
|
||||||
*
|
*
|
||||||
* @param string|array $set =array() URL (incl. protocol!)
|
* @param string|array $set =null URL (incl. protocol!)
|
||||||
* @return string with attributes eg. "'unsafe-inline'"
|
* @deprecated use Api\Header\ContentSecurityPolicy::add('frame-src', $set);
|
||||||
*/
|
*/
|
||||||
public static function csp_frame_src_attrs($set=null)
|
public static function csp_frame_src_attrs($set=null)
|
||||||
{
|
{
|
||||||
// set frame-src attrs of API and apps via hook
|
Api\Header\ContentSecurityPolicy::add('frame-src', $set);
|
||||||
if (!isset(self::$csp_frame_src_attrs) && !isset($set))
|
|
||||||
{
|
|
||||||
$frame_src = array('manual.egroupware.org', 'www.egroupware.org');
|
|
||||||
if (($app_additional = $GLOBALS['egw']->hooks->process('csp-frame-src')))
|
|
||||||
{
|
|
||||||
foreach($app_additional as $addtional)
|
|
||||||
{
|
|
||||||
if ($addtional) $frame_src = array_unique(array_merge($frame_src, $addtional));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return self::csp_frame_src_attrs($frame_src);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!isset(self::$csp_frame_src_attrs)) self::$csp_frame_src_attrs = array();
|
|
||||||
|
|
||||||
foreach((array)$set as $attr)
|
|
||||||
{
|
|
||||||
if (!in_array($attr, self::$csp_frame_src_attrs))
|
|
||||||
{
|
|
||||||
self::$csp_frame_src_attrs[] = $attr;
|
|
||||||
//error_log(__METHOD__."() setting CSP script-src $attr ".function_backtrace());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
//error_log(__METHOD__."(".array2string($set).") returned ".array2string(implode(' ', self::$csp_frame_src_attrs)).' '.function_backtrace());
|
|
||||||
return implode(' ', self::$csp_frame_src_attrs);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -281,20 +191,7 @@ abstract class egw_framework
|
|||||||
// add a content-type header to overwrite an existing default charset in apache (AddDefaultCharset directiv)
|
// add a content-type header to overwrite an existing default charset in apache (AddDefaultCharset directiv)
|
||||||
header('Content-type: text/html; charset='.translation::charset());
|
header('Content-type: text/html; charset='.translation::charset());
|
||||||
|
|
||||||
// content-security-policy header:
|
Api\Header\ContentSecurityPolicy::send();
|
||||||
// - "script-src 'self' 'unsafe-eval'" allows only self and eval (eg. ckeditor), but forbids inline scripts, onchange, etc
|
|
||||||
// - "connect-src 'self'" allows ajax requests only to self
|
|
||||||
// - "style-src 'self' 'unsave-inline'" allows only self and inline style, which we need
|
|
||||||
// - "frame-src 'self' manual.egroupware.org" allows frame and iframe content only for self or manual.egroupware.org
|
|
||||||
$csp = "script-src 'self' ".self::csp_script_src_attrs().
|
|
||||||
"; connect-src 'self' ".self::csp_connect_src_attrs().
|
|
||||||
"; style-src 'self' ".self::csp_style_src_attrs().
|
|
||||||
"; frame-src 'self' ".self::csp_frame_src_attrs();
|
|
||||||
|
|
||||||
//$csp = "default-src * 'unsafe-eval' 'unsafe-inline'"; // allow everything
|
|
||||||
header("Content-Security-Policy: $csp");
|
|
||||||
header("X-Webkit-CSP: $csp"); // Chrome: <= 24, Safari incl. iOS
|
|
||||||
header("X-Content-Security-Policy: $csp"); // FF <= 22
|
|
||||||
|
|
||||||
// allow client-side to detect first load aka just logged in
|
// allow client-side to detect first load aka just logged in
|
||||||
$reload_count =& egw_cache::getSession(__CLASS__, 'framework-reload');
|
$reload_count =& egw_cache::getSession(__CLASS__, 'framework-reload');
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user