Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* Adjust for security leaks.

Browse Source
This commit is contained in:
wangyidong
2021-04-08 13:34:47 +08:00
parent 8a031d2ca4
commit bb490ddbdc
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/config.php
+10
View File
@@ -89,6 +89,10 @@ $config->domainPostfix .= "|villas|foundation|expert|works|tools|watch|zone|barg
$config->domainPostfix .= "|farm|pics|photo|marketing|holiday|gift|buzz|guitars|trade|construction|";
$config->domainPostfix .= "|international|house|coffee|florist|rich|ceo|camp|education|repair|win|site|";
/* Config for Content-Security-Policy. */
$config->CSPs = array();
$config->CSPs[] = "form-action 'self';connect-src 'self'";
/* 系统框架配置。Framework settings. */
$config->framework = new stdclass();
$config->framework->autoConnectDB = true; // 是否自动连接数据库。 Whether auto connect database or not.
@@ -107,6 +111,12 @@ $config->framework->autoRepairTable = true;
$config->framework->autoLang = false;
$config->framework->filterCSRF = false;
$config->framework->setCookieSecure = true;
$config->framework->sendXCTO = true; // Send X-Content-Type-Options header.
$config->framework->sendXXP = true; // Send X-XSS-Protection header.
$config->framework->sendHSTS = true; // Send HTTP Strict Transport Security header.
$config->framework->sendRP = true; // Send Referrer-Policy header.
$config->framework->sendXPCDP = true; // Send X-Permitted-Cross-Domain-Policies header.
$config->framework->sendXDO = true; // Send X-Download-Options header.
$config->framework->detectDevice['zh-cn'] = true; // 在zh-cn语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
$config->framework->detectDevice['zh-tw'] = true; // 在zh-tw语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
module/common/model.php
+14
View File
@@ -47,6 +47,20 @@ class commonModel extends model
header("Content-Type: text/html; Language={$this->config->charset}");
header("Cache-control: private");
/* Send HTTP header. */
if($this->config->framework->sendXCTO) header("X-Content-Type-Options: nosniff");
if($this->config->framework->sendXXP) header("X-XSS-Protection: 1; mode=block");
if($this->config->framework->sendHSTS) header("Strict-Transport-Security: max-age=3600; includeSubDomains");
if($this->config->framework->sendRP) header("Referrer-Policy: no-referrer-when-downgrade");
if($this->config->framework->sendXPCDP) header("X-Permitted-Cross-Domain-Policies: master-only");
if($this->config->framework->sendXDO) header("X-Download-Options: noopen");
/* Set Content-Security-Policy header. */
if($this->config->CSPs)
{
foreach($this->config->CSPs as $CSP) header("Content-Security-Policy: $CSP;");
}
if($this->loadModel('setting')->getItem('owner=system&module=sso&key=turnon'))
{
if(isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on')