From 71baea4fa255912113ad3067b74de72d2f09ce7f Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Thu, 4 May 2017 16:50:35 +0200 Subject: [webinterface] Add separate option to enable HSTS --- modules-available/webinterface/lang/de/template-tags.json | 1 + modules-available/webinterface/lang/en/template-tags.json | 1 + modules-available/webinterface/page.inc.php | 6 +++++- modules-available/webinterface/templates/https.html | 6 ++++++ 4 files changed, 13 insertions(+), 1 deletion(-) (limited to 'modules-available/webinterface') diff --git a/modules-available/webinterface/lang/de/template-tags.json b/modules-available/webinterface/lang/de/template-tags.json index ea1074d2..719dbdd6 100644 --- a/modules-available/webinterface/lang/de/template-tags.json +++ b/modules-available/webinterface/lang/de/template-tags.json @@ -18,6 +18,7 @@ "lang_showPasswords": "Passw\u00f6rter anzeigen", "lang_suppliedSelected": "Der Server verwendet zur Zeit ein \u00fcber die Option \"Eigenes Zertifikat\" hochgeladenes Zertifikat.", "lang_unknownSelected": "Unbekanntes oder ung\u00fcltiges Zertifikat vorhanden. Wahrscheinlich wurde der Server von einer alten Version aktualisiert. Um diese Meldung zu entfernen, die HTTPS-Konfiguration erneut vornehmen.", + "lang_useHsts": "HSTS aktivieren (dies erh\u00f6ht die Sicherheit, kann aber in bei sp\u00e4terem Deaktivieren von HTTPS zu Zugriffsproblemen f\u00fchren)", "lang_youreNotUsingHttps": "Sie besuchen diese Seite nicht per HTTPS (oder die HTTPS-Terminierung wird von einem vorgeschalteten Proxy \u00fcbernommen).", "lang_youreUsingHttps": "Sie besuchen diese Seite (aus Sicht des Webservers) per HTTPS." } \ No newline at end of file diff --git a/modules-available/webinterface/lang/en/template-tags.json b/modules-available/webinterface/lang/en/template-tags.json index efe649cb..be521dcb 100644 --- a/modules-available/webinterface/lang/en/template-tags.json +++ b/modules-available/webinterface/lang/en/template-tags.json @@ -18,6 +18,7 @@ "lang_showPasswords": "Show passwords", "lang_suppliedSelected": "The server is currently using a certificate supplied using the \"Supply own certificate\" option.", "lang_unknownSelected": "Unknown or invalid certificate in use. The server war probably updated from an old version while HTTPS was already enabled. Redo the HTTPS configuration steps to get rid of this message.", + "lang_useHsts": "Use HSTS (increases security but might lead to problems accessing the site if you disable HTTPS later)", "lang_youreNotUsingHttps": "You're not using HTTPS to visit this website (or the HTTPS termination is done by a reverse proxy).", "lang_youreUsingHttps": "You're visiting this server through an HTTPS connection (from the server's point of view)." } \ No newline at end of file diff --git a/modules-available/webinterface/page.inc.php b/modules-available/webinterface/page.inc.php index 93d659f0..5207420a 100644 --- a/modules-available/webinterface/page.inc.php +++ b/modules-available/webinterface/page.inc.php @@ -5,6 +5,7 @@ class Page_WebInterface extends Page const PROP_REDIRECT = 'webinterface.https-redirect'; const PROP_TYPE = 'webinterface.https-type'; + const PROP_HSTS = 'webinterface.https-hsts'; protected function doPreprocess() { @@ -42,6 +43,7 @@ class Page_WebInterface extends Page $task = $this->setRedirectMode(); break; } + Property::set(self::PROP_HSTS, Request::post('usehsts', false, 'string') === 'on' ? 'True' : 'False'); if (isset($task['id'])) { Session::set('https-id', $task['id']); Util::redirect('?do=WebInterface&show=httpsupdate' . $off); @@ -65,11 +67,13 @@ class Page_WebInterface extends Page } $type = Property::get(self::PROP_TYPE); $force = Property::get(self::PROP_REDIRECT) === 'True'; + $hsts = Property::get(self::PROP_HSTS) === 'True'; $https = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'; $exists = file_exists('/etc/lighttpd/server.pem'); $data = array( 'httpsUsed' => $https, - 'redirect_checked' => ($force ? 'checked' : '') + 'redirect_checked' => ($force ? 'checked' : ''), + 'hsts_checked' => ($hsts ? 'checked' : '') ); // Type should be 'off', 'generated', 'supplied' if ($type === 'off') { diff --git a/modules-available/webinterface/templates/https.html b/modules-available/webinterface/templates/https.html index 77585ddf..ecfe5f5d 100644 --- a/modules-available/webinterface/templates/https.html +++ b/modules-available/webinterface/templates/https.html @@ -78,6 +78,12 @@ MIIFfTCCA... {{lang_httpsRedirect}} +
+ + + {{lang_useHsts}} + +

-- cgit v1.2.3-55-g7522 From f7900fa08276d2668221a1b4ce7462d68e6f2893 Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Fri, 5 May 2017 13:04:19 +0200 Subject: [webinterface] Log user out when disabling HTTPS to prevent lockout --- inc/session.inc.php | 9 +++++++-- index.php | 2 +- modules-available/webinterface/page.inc.php | 14 ++++++++------ 3 files changed, 16 insertions(+), 9 deletions(-) (limited to 'modules-available/webinterface') diff --git a/inc/session.inc.php b/inc/session.inc.php index 26effa3f..24bf6ac0 100644 --- a/inc/session.inc.php +++ b/inc/session.inc.php @@ -74,10 +74,15 @@ class Session { if (self::$sid === false) return; @unlink(self::getSessionFile()); - @setcookie('sid', '', time() - 8640000, null, null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', true); + self::deleteCookie(); self::$sid = false; self::$data = false; } + + public static function deleteCookie() + { + setcookie('sid', '', time() - 8640000, null, null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', true); + } private static function getSessionFile() { @@ -104,7 +109,7 @@ class Session $sessionfile = self::getSessionFile(); $ret = @file_put_contents($sessionfile, @serialize(self::$data)); if (!$ret) Util::traceError('Storing session data in ' . $sessionfile . ' failed.'); - $ret = @setcookie('sid', self::$sid, time() + CONFIG_SESSION_TIMEOUT, null, null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', true); + $ret = setcookie('sid', self::$sid, time() + CONFIG_SESSION_TIMEOUT, null, null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', true); if (!$ret) Util::traceError('Error: Could not set Cookie for Client (headers already sent)'); } } diff --git a/index.php b/index.php index 7cbb3b40..a3f45ff3 100644 --- a/index.php +++ b/index.php @@ -116,7 +116,7 @@ if (defined('CONFIG_DEBUG') && CONFIG_DEBUG) { // Set HSTS Header if client is using HTTPS if(!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') { - if (Request::any('hsts') === 'off' || Property::get('webinterface.https-hsts', 'False') !== 'True') { + if (Property::get('webinterface.https-hsts', 'False') !== 'True') { Header('Strict-Transport-Security: max-age=0', true); } else { Header('Strict-Transport-Security: max-age=15768000', true); diff --git a/modules-available/webinterface/page.inc.php b/modules-available/webinterface/page.inc.php index 5207420a..ae9a94fd 100644 --- a/modules-available/webinterface/page.inc.php +++ b/modules-available/webinterface/page.inc.php @@ -26,12 +26,10 @@ class Page_WebInterface extends Page private function actionConfigureHttps() { - $task = false; - $off = ''; - switch (Request::post('mode')) { + $mode = Request::post('mode'); + switch ($mode) { case 'off': $task = $this->setHttpsOff(); - $off = '&hsts=off'; break; case 'random': $task = $this->setHttpsRandomCert(); @@ -43,10 +41,12 @@ class Page_WebInterface extends Page $task = $this->setRedirectMode(); break; } - Property::set(self::PROP_HSTS, Request::post('usehsts', false, 'string') === 'on' ? 'True' : 'False'); + if ($mode !== 'off') { + Property::set(self::PROP_HSTS, Request::post('usehsts', false, 'string') === 'on' ? 'True' : 'False'); + } if (isset($task['id'])) { Session::set('https-id', $task['id']); - Util::redirect('?do=WebInterface&show=httpsupdate' . $off); + Util::redirect('?do=WebInterface&show=httpsupdate'); } Util::redirect('?do=WebInterface'); } @@ -123,7 +123,9 @@ class Page_WebInterface extends Page private function setHttpsOff() { Property::set(self::PROP_TYPE, 'off'); + Property::set(self::PROP_HSTS, 'off'); Header('Strict-Transport-Security: max-age=0', true); + Session::deleteCookie(); return Taskmanager::submit('LighttpdHttps', array()); } -- cgit v1.2.3-55-g7522 From 16dc9cfeea4bc060982f0b364ddaac98095ef654 Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Tue, 9 May 2017 14:30:30 +0200 Subject: [webinterface] Allow customizing page title prefix and logo bgcolor --- inc/render.inc.php | 19 +++++++++++++- modules-available/main/templates/main-menu.html | 1 + modules-available/webinterface/page.inc.php | 30 ++++++++++++++++++++++ .../webinterface/templates/customization.html | 30 ++++++++++++++++++++++ 4 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 modules-available/webinterface/templates/customization.html (limited to 'modules-available/webinterface') diff --git a/inc/render.inc.php b/inc/render.inc.php index 5515c659..c34c285a 100644 --- a/inc/render.inc.php +++ b/inc/render.inc.php @@ -40,6 +40,11 @@ class Render self::$mustache = new Mustache_Engine($options); } + private static function cssEsc($str) + { + return str_replace(array('"', '&', '<', '>'), array('\\000022', '\\000026', '\\00003c', '\\00003e'), $str); + } + /** * Output the buffered, generated page */ @@ -47,12 +52,24 @@ class Render { Header('Content-Type: text/html; charset=utf-8'); $modules = array_reverse(Module::getActivated()); + $title = Property::get('page-title-prefix', ''); + $bgcolor = Property::get('logo-background', ''); + if (!empty($bgcolor) || !empty($title)) { + self::$header .= '"; + } ob_start('ob_gzhandler'); echo ' - ', self::$title, RENDER_DEFAULT_TITLE, ' + ', $title, self::$title, RENDER_DEFAULT_TITLE, ' diff --git a/modules-available/main/templates/main-menu.html b/modules-available/main/templates/main-menu.html index 2ede4f87..55b19833 100644 --- a/modules-available/main/templates/main-menu.html +++ b/modules-available/main/templates/main-menu.html @@ -20,6 +20,7 @@ OpenSLX +