github
/
portainer
mirror of https://github.com/portainer/portainer
1
0
Fork 0
Code Issues Releases Wiki Activity

feat(security): update secured headers and sanitize team name (#2167)

pull/2210/head
Anthony Lapenna 2018-08-23 17:10:18 +02:00 committed by GitHub
parent e58acd7dd6
commit 8cd3964d75
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
api/http/handler/file/handler.go
View File

@ -33,5 +33,9 @@ func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
} else { } else {
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate") w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
} }
w.Header().Add("X-Frame-Options", "DENY")
w.Header().Add("X-XSS-Protection", "1; mode=block")
w.Header().Add("X-Content-Type-Options", "nosniff")
handler.Handler.ServeHTTP(w, r) handler.Handler.ServeHTTP(w, r)
} }

3
api/http/security/bouncer.go
View File

@ -114,8 +114,9 @@ func (bouncer *RequestBouncer) EndpointAccess(r *http.Request, endpoint *portain
// mwSecureHeaders provides secure headers middleware for handlers. // mwSecureHeaders provides secure headers middleware for handlers.
func mwSecureHeaders(next http.Handler) http.Handler { func mwSecureHeaders(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Add("X-Content-Type-Options", "nosniff")
w.Header().Add("X-Frame-Options", "DENY") w.Header().Add("X-Frame-Options", "DENY")
w.Header().Add("X-XSS-Protection", "1; mode=block")
w.Header().Add("X-Content-Type-Options", "nosniff")
next.ServeHTTP(w, r) next.ServeHTTP(w, r)
}) })
} }

6
app/portainer/views/teams/teamsController.js
View File

@ -1,6 +1,6 @@
angular.module('portainer.app') angular.module('portainer.app')
.controller('TeamsController', ['$q', '$scope', '$state', 'TeamService', 'UserService', 'ModalService', 'Notifications', 'Authentication', .controller('TeamsController', ['$q', '$scope', '$state', '$sanitize', 'TeamService', 'UserService', 'ModalService', 'Notifications', 'Authentication',
function ($q, $scope, $state, TeamService, UserService, ModalService, Notifications, Authentication) { function ($q, $scope, $state, $sanitize, TeamService, UserService, ModalService, Notifications, Authentication) {
$scope.state = { $scope.state = {
actionInProgress: false actionInProgress: false
}; };
@ -22,7 +22,7 @@ function ($q, $scope, $state, TeamService, UserService, ModalService, Notificati
}; };
$scope.addTeam = function() { $scope.addTeam = function() {
var teamName = $scope.formValues.Name; var teamName = $sanitize($scope.formValues.Name);
var leaderIds = []; var leaderIds = [];
angular.forEach($scope.formValues.Leaders, function(user) { angular.forEach($scope.formValues.Leaders, function(user) {
leaderIds.push(user.Id); leaderIds.push(user.Id);