Remove the need of css unsafe-inline

2022-06-09 18:19:54 +02:00 · 2022-06-09 18:19:54 +02:00 · ec3d0ca044
commit ec3d0ca044
parent 9bc9b459b2
10 changed files with 83 additions and 32 deletions
--- a/app/Http/Middleware/SecureHeaders.php
+++ b/app/Http/Middleware/SecureHeaders.php
@ -43,10 +43,16 @@ class SecureHeaders
        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
        $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');
        $cspPolicies = [
+            // * CKEDITOR Specific https://ckeditor.com/docs/ckeditor5/latest/installation/advanced/csp.html
+            "connect-src 'self'",
+            "img-src * data:",
+            "frame-src *",
+
+            "font-src 'self'",
            // phpcs:ignore Generic.Files.LineLength.TooLong
-            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;",
+            "style-src 'self' https: 'nonce-$nonce' https://fonts.googleapis.com;",
            // phpcs:ignore Generic.Files.LineLength.TooLong
-            "script-src 'self' $jsDev https://cdnjs.cloudflare.com;"
+            "script-src 'self' https: $jsDev https://cdnjs.cloudflare.com;"
        ];
        $response->headers->set(
            'Content-Security-Policy',
--- a/composer.json
+++ b/composer.json
@ -15,7 +15,7 @@
        "fideloper/proxy": "^4.4",
        "fruitcake/laravel-cors": "^2.0",
        "guzzlehttp/guzzle": "^7.0.1",
-        "kwaadpepper/crud-policies": "^0.4.2",
+        "kwaadpepper/crud-policies": "^0.4.3",
        "kwaadpepper/enum": "^2.1",
        "kwaadpepper/exception-handler": "^0.0.5",
        "laravel-lang/lang": "~8.0",
--- a/composer.lock
+++ b/composer.lock
@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "dbb480b9fd36eeda261c73207b52e630",
+    "content-hash": "24465e408942875ac35d03585b7b52fb",
    "packages": [
        {
            "name": "asm89/stack-cors",
@ -1505,16 +1505,16 @@
        },
        {
            "name": "kwaadpepper/crud-policies",
-            "version": "0.4.2",
+            "version": "0.4.3",
            "source": {
                "type": "git",
                "url": "https://github.com/Kwaadpepper/crud-policies.git",
-                "reference": "2bd1f55dc6ec13f198c5f1e40e360e0b498512bb"
+                "reference": "8385611d8691cc70dbd50e670c7bee7f5ef9d861"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/Kwaadpepper/crud-policies/zipball/2bd1f55dc6ec13f198c5f1e40e360e0b498512bb",
-                "reference": "2bd1f55dc6ec13f198c5f1e40e360e0b498512bb",
+                "url": "https://api.github.com/repos/Kwaadpepper/crud-policies/zipball/8385611d8691cc70dbd50e670c7bee7f5ef9d861",
+                "reference": "8385611d8691cc70dbd50e670c7bee7f5ef9d861",
                "shasum": ""
            },
            "require": {
@ -1565,9 +1565,9 @@
            ],
            "support": {
                "issues": "https://github.com/Kwaadpepper/crud-policies/issues",
-                "source": "https://github.com/Kwaadpepper/crud-policies/tree/0.4.2"
+                "source": "https://github.com/Kwaadpepper/crud-policies/tree/0.4.3"
            },
-            "time": "2022-06-09T11:34:54+00:00"
+            "time": "2022-06-09T16:06:28+00:00"
        },
        {
            "name": "kwaadpepper/enum",
--- a/package-lock.json
+++ b/package-lock.json
@ -7,6 +7,7 @@
            "devDependencies": {
                "@babel/plugin-transform-async-to-generator": "^7.16.8",
                "@fortawesome/fontawesome-free": "^6.1.1",
+                "@fortawesome/fontawesome-svg-core": "^6.1.1",
                "@popperjs/core": "^2.11.5",
                "@vue/compiler-sfc": "^3.2.37",
                "autoprefixer": "10.4.5",
@ -15,7 +16,7 @@
                "clean-webpack-plugin": "^4.0.0",
                "cross-env": "^7.0",
                "del-cli": "^4.0.1",
-                "fslightbox": "^3.2.3",
+                "glightbox": "^3.2.0",
                "laravel-mix": "^6.0.16",
                "laravel-mix-clean": "^0.1.0",
                "laravel-mix-polyfill": "^3.0.1",
@ -1659,6 +1660,16 @@
                "node": ">=10.0.0"
            }
        },
+        "node_modules/@fortawesome/fontawesome-common-types": {
+            "version": "6.1.1",
+            "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-common-types/-/fontawesome-common-types-6.1.1.tgz",
+            "integrity": "sha512-wVn5WJPirFTnzN6tR95abCx+ocH+3IFLXAgyavnf9hUmN0CfWoDjPT/BAWsUVwSlYYVBeCLJxaqi7ZGe4uSjBA==",
+            "dev": true,
+            "hasInstallScript": true,
+            "engines": {
+                "node": ">=6"
+            }
+        },
        "node_modules/@fortawesome/fontawesome-free": {
            "version": "6.1.1",
            "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-free/-/fontawesome-free-6.1.1.tgz",
@ -1669,6 +1680,19 @@
                "node": ">=6"
            }
        },
+        "node_modules/@fortawesome/fontawesome-svg-core": {
+            "version": "6.1.1",
+            "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/fontawesome-svg-core-6.1.1.tgz",
+            "integrity": "sha512-NCg0w2YIp81f4V6cMGD9iomfsIj7GWrqmsa0ZsPh59G7PKiGN1KymZNxmF00ssuAlo/VZmpK6xazsGOwzKYUMg==",
+            "dev": true,
+            "hasInstallScript": true,
+            "dependencies": {
+                "@fortawesome/fontawesome-common-types": "6.1.1"
+            },
+            "engines": {
+                "node": ">=6"
+            }
+        },
        "node_modules/@jridgewell/gen-mapping": {
            "version": "0.1.1",
            "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz",
@ -5040,12 +5064,6 @@
                "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
            }
        },
-        "node_modules/fslightbox": {
-            "version": "3.3.1",
-            "resolved": "https://registry.npmjs.org/fslightbox/-/fslightbox-3.3.1.tgz",
-            "integrity": "sha512-r8mS2lnqw+4F7fQmIXZ4Y+tulxqGsZyG7wzMhWKl8MHvVZRJnclUyt+n+hfTkUa+e1bvlzpw4tY/X9mwqC4wCg==",
-            "dev": true
-        },
        "node_modules/function-bind": {
            "version": "1.1.1",
            "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
@ -5096,6 +5114,12 @@
                "url": "https://github.com/sponsors/sindresorhus"
            }
        },
+        "node_modules/glightbox": {
+            "version": "3.2.0",
+            "resolved": "https://registry.npmjs.org/glightbox/-/glightbox-3.2.0.tgz",
+            "integrity": "sha512-iit1xYixqL4YVL+I2YJLfMeyJwvLi6FE6kY3qNKeZHEJgRIz80QU8Rm7YCyw1wOTgXvmNDnXGVhHOHRCwnDltQ==",
+            "dev": true
+        },
        "node_modules/glob": {
            "version": "7.2.3",
            "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
@ -11778,12 +11802,27 @@
            "integrity": "sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw==",
            "dev": true
        },
+        "@fortawesome/fontawesome-common-types": {
+            "version": "6.1.1",
+            "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-common-types/-/fontawesome-common-types-6.1.1.tgz",
+            "integrity": "sha512-wVn5WJPirFTnzN6tR95abCx+ocH+3IFLXAgyavnf9hUmN0CfWoDjPT/BAWsUVwSlYYVBeCLJxaqi7ZGe4uSjBA==",
+            "dev": true
+        },
        "@fortawesome/fontawesome-free": {
            "version": "6.1.1",
            "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-free/-/fontawesome-free-6.1.1.tgz",
            "integrity": "sha512-J/3yg2AIXc9wznaVqpHVX3Wa5jwKovVF0AMYSnbmcXTiL3PpRPfF58pzWucCwEiCJBp+hCNRLWClTomD8SseKg==",
            "dev": true
        },
+        "@fortawesome/fontawesome-svg-core": {
+            "version": "6.1.1",
+            "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/fontawesome-svg-core-6.1.1.tgz",
+            "integrity": "sha512-NCg0w2YIp81f4V6cMGD9iomfsIj7GWrqmsa0ZsPh59G7PKiGN1KymZNxmF00ssuAlo/VZmpK6xazsGOwzKYUMg==",
+            "dev": true,
+            "requires": {
+                "@fortawesome/fontawesome-common-types": "6.1.1"
+            }
+        },
        "@jridgewell/gen-mapping": {
            "version": "0.1.1",
            "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz",
@ -14502,12 +14541,6 @@
            "dev": true,
            "optional": true
        },
-        "fslightbox": {
-            "version": "3.3.1",
-            "resolved": "https://registry.npmjs.org/fslightbox/-/fslightbox-3.3.1.tgz",
-            "integrity": "sha512-r8mS2lnqw+4F7fQmIXZ4Y+tulxqGsZyG7wzMhWKl8MHvVZRJnclUyt+n+hfTkUa+e1bvlzpw4tY/X9mwqC4wCg==",
-            "dev": true
-        },
        "function-bind": {
            "version": "1.1.1",
            "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
@ -14543,6 +14576,12 @@
            "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
            "dev": true
        },
+        "glightbox": {
+            "version": "3.2.0",
+            "resolved": "https://registry.npmjs.org/glightbox/-/glightbox-3.2.0.tgz",
+            "integrity": "sha512-iit1xYixqL4YVL+I2YJLfMeyJwvLi6FE6kY3qNKeZHEJgRIz80QU8Rm7YCyw1wOTgXvmNDnXGVhHOHRCwnDltQ==",
+            "dev": true
+        },
        "glob": {
            "version": "7.2.3",
            "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
--- a/package.json
+++ b/package.json
@ -13,6 +13,7 @@
    "devDependencies": {
        "@babel/plugin-transform-async-to-generator": "^7.16.8",
        "@fortawesome/fontawesome-free": "^6.1.1",
+        "@fortawesome/fontawesome-svg-core": "^6.1.1",
        "@popperjs/core": "^2.11.5",
        "@vue/compiler-sfc": "^3.2.37",
        "autoprefixer": "10.4.5",
@ -21,7 +22,7 @@
        "clean-webpack-plugin": "^4.0.0",
        "cross-env": "^7.0",
        "del-cli": "^4.0.1",
-        "fslightbox": "^3.2.3",
+        "glightbox": "^3.2.0",
        "laravel-mix": "^6.0.16",
        "laravel-mix-clean": "^0.1.0",
        "laravel-mix-polyfill": "^3.0.1",
--- a/resources/js/bootstrap.js
+++ b/resources/js/bootstrap.js
@ -1,5 +1,6 @@
 // SweetAlert
-import Swal from 'sweetalert2'
+import Swal from 'sweetalert2/dist/sweetalert2.js'
+import GLightbox from 'glightbox'

 // bootstrap styling
 window.Swal = Swal.mixin({
@ -27,5 +28,6 @@ if (csrfToken.getAttribute('content')) {
    window.axios.defaults.headers.common['X-CSRF-TOKEN'] = csrfToken.getAttribute('content')
 }

-
-require('fslightbox')
+const glightbox = new GLightbox({
+    'selector': '.glightbox'
+})
--- a/resources/sass/bootstrap.scss
+++ b/resources/sass/bootstrap.scss
@ -1,5 +1,8 @@
@import 'variables';
@import '~bootstrap/scss/bootstrap';
+@import '~sweetalert2/dist/sweetalert2.css';
+@import '~@fortawesome/fontawesome-svg-core/styles.css';
+@import '~glightbox/dist/css/glightbox.css';
@import 'bootswatch';

 // OVERLOAD BOOTSTRAP
--- a/resources/views/layout/app.blade.php
+++ b/resources/views/layout/app.blade.php
@ -42,7 +42,7 @@
    @include('layout.footer')
    @stack('scriptsConstants')
    <script src="{{ mix('js/app.js') }}"></script>
-    <script src="{{ mix('js/fontawesome.min.js') }}"></script>
+    <script src="{{ mix('js/fontawesome.min.js') }}" data-auto-add-css="false"></script>
    @stack('scripts')
    @crudPoliciesJS()
    @auth
--- a/resources/views/ticket/index.blade.php
+++ b/resources/views/ticket/index.blade.php
@ -185,10 +185,10 @@ $userPr = Auth::user()->sites ?? collect([]);
                                        <div>
                                            <div class="btn-group" role="group">
                                                @if ($ticket->file !== null)
-                                                <a data-fslightbox="gallery{{ $ticket->id }}" href="{{ asset($ticket->file) }}" class="btn btn-outline-dark" target="_blank"><i class="fa-solid fa-file-image"></i></a>
+                                                <a data-gallery="gallery{{ $ticket->id }}" href="{{ asset($ticket->file) }}" class="glightbox btn btn-outline-dark" target="_blank"><i class="fa-solid fa-file-image"></i></a>
                                                @endif
                                                @if ($ticket->file2 !== null)
-                                                <a data-fslightbox="gallery{{ $ticket->id }}" href="{{ asset($ticket->file2) }}" class="btn btn-outline-dark {{ $ticket->file !== null ? 'd-none' : '' }}" target="_blank"></a>
+                                                <a data-gallery="gallery{{ $ticket->id }}" href="{{ asset($ticket->file2) }}" class="glightbox btn btn-outline-dark {{ $ticket->file !== null ? 'd-none' : '' }}" target="_blank"></a>
                                                @endif
                                                {{-- Modal du ticket --}}
                                                <!-- Button trigger modal -->
--- a/resources/views/ticket/show.blade.php
+++ b/resources/views/ticket/show.blade.php
@ -214,13 +214,13 @@
        @if (!is_null($ticket->file))
        <li>
            {{ __('Pièce jointe n°1') }} :
-            <a @if(ToolboxHelper::isImageFile($ticket->file))data-fslightbox="gallery" @endif href="{{ asset($ticket->file) }}" target="_blank">{{ __('Ouvrir la pièce jointe') }}</a>
+            <a @if(ToolboxHelper::isImageFile($ticket->file)) class="glightbox" data-gallery="ticket" @endif href="{{ asset($ticket->file) }}" target="_blank">{{ __('Ouvrir la pièce jointe') }}</a>
        </li>
        @endif
        @if (!is_null($ticket->file2))
        <li>
            {{ __('Pièce jointe n°2') }} :
-            <a @if(ToolboxHelper::isImageFile($ticket->file2))data-fslightbox="gallery" @endif href="{{ asset($ticket->file2) }}" target="_blank">{{ __('Ouvrir la pièce jointe') }}</a>
+            <a @if(ToolboxHelper::isImageFile($ticket->file2)) class="glightbox" data-gallery="ticket" @endif href="{{ asset($ticket->file2) }}" target="_blank">{{ __('Ouvrir la pièce jointe') }}</a>
        </li>
        @endif
    </ul>