mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
076157c1a6
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40538 This is the initial iteration of CSP functionality, currently gated behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces are still injected into pages however a dummy nonce is used and has no effect. With this setting turned on things break and will be addressed by mainly frontend changes in https://github.com/fleetdm/fleet/issues/41577 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually --------- Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
39 lines
1.1 KiB
Text
39 lines
1.1 KiB
Text
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="robots" content="noindex" />
|
|
<meta name="viewport" content="width=768" id="viewport-meta-tag" />
|
|
<meta property="csp-nonce" content="{{.CSPNonce}}" />
|
|
|
|
<script nonce="{{.CSPNonce}}">
|
|
// If URL contains /device/, set mobile-friendly viewport
|
|
if (window.location.pathname.includes("/device/")) {
|
|
document
|
|
.getElementById("viewport-meta-tag")
|
|
.setAttribute("content", "width=device-width, initial-scale=1.0");
|
|
}
|
|
</script>
|
|
|
|
<link
|
|
rel="stylesheet"
|
|
type="text/css"
|
|
href="{{.URLPrefix}}<%= htmlWebpackPlugin.files.css[0] %>"
|
|
/>
|
|
<link rel="shortcut icon" href="{{.URLPrefix}}/assets/favicon.ico" />
|
|
|
|
<title>Fleet</title>
|
|
<script type="text/javascript" nonce="{{.CSPNonce}}}">
|
|
var urlPrefix = "{{.URLPrefix}}";
|
|
</script>
|
|
</head>
|
|
<body>
|
|
<div id="app"></div>
|
|
<script
|
|
async
|
|
defer
|
|
nonce="{{.CSPNonce}}"
|
|
src="{{.URLPrefix}}<%= htmlWebpackPlugin.files.js[0] %>"
|
|
></script>
|
|
</body>
|
|
</html>
|