diff --git a/azure-pipelines.yml b/azure-pipelines.yml index 9fffef35..a90cd262 100644 --- a/azure-pipelines.yml +++ b/azure-pipelines.yml @@ -10,7 +10,7 @@ pool: variables: buildConfiguration: 'Release' - version: 2.40 + version: 2.41 steps: - task: UseDotNet@2 diff --git a/source/DasBlog.Services/ConfigFile/Interfaces/ISiteConfig.cs b/source/DasBlog.Services/ConfigFile/Interfaces/ISiteConfig.cs index c1ea752a..551346ea 100644 --- a/source/DasBlog.Services/ConfigFile/Interfaces/ISiteConfig.cs +++ b/source/DasBlog.Services/ConfigFile/Interfaces/ISiteConfig.cs @@ -346,6 +346,8 @@ public interface ISiteConfig string SecurityStyleSources { get; set; } + string DefaultSources { get; set; } + bool CookieConsentEnabled { get; set; } bool EnableDoubleDecode { get; set; } diff --git a/source/DasBlog.Services/ConfigFile/SiteConfig.cs b/source/DasBlog.Services/ConfigFile/SiteConfig.cs index 5f23feb9..5100ed91 100644 --- a/source/DasBlog.Services/ConfigFile/SiteConfig.cs +++ b/source/DasBlog.Services/ConfigFile/SiteConfig.cs @@ -215,6 +215,9 @@ public SiteConfig() { } public string SecurityScriptSources { get; set; } public string SecurityStyleSources { get; set; } - public bool EnableDoubleDecode { get; set; } + + public string DefaultSources { get; set; } + + public bool EnableDoubleDecode { get; set; } } } diff --git a/source/DasBlog.Services/DasBlog.Services.csproj b/source/DasBlog.Services/DasBlog.Services.csproj index 5d2d179c..80a9f230 100644 --- a/source/DasBlog.Services/DasBlog.Services.csproj +++ b/source/DasBlog.Services/DasBlog.Services.csproj @@ -2,7 +2,7 @@ netcoreapp3.1 - 2.40.0 + 3.0.0 diff --git a/source/DasBlog.Tests/UnitTests/SiteConfigTest.cs b/source/DasBlog.Tests/UnitTests/SiteConfigTest.cs index 733b8db3..05a3e262 100644 --- a/source/DasBlog.Tests/UnitTests/SiteConfigTest.cs +++ b/source/DasBlog.Tests/UnitTests/SiteConfigTest.cs @@ -166,5 +166,6 @@ public class SiteConfigTest : ISiteConfig public string SecurityStyleSources { get; set; } public bool EnableDoubleDecode { get => throw new NotImplementedException(); set => throw new NotImplementedException(); } + public string DefaultSources { get => throw new NotImplementedException(); set => throw new NotImplementedException(); } } } diff --git a/source/DasBlog.Web.UI/Config/site.config b/source/DasBlog.Web.UI/Config/site.config index ba38df80..4e2cc448 100644 --- a/source/DasBlog.Web.UI/Config/site.config +++ b/source/DasBlog.Web.UI/Config/site.config @@ -112,6 +112,7 @@ false + data:;https: cloud.tinymce.com;cdn.tiny.cloud;cdn.jsdelivr.net;js.nicedit.com;www.google.com;platform.twitter.com;cdn.syndication.twimg.com;fonts.googleapis.com;maxcdn.bootstrapcdn.com cloud.tinymce.com;cdn.tiny.cloud;cdn.jsdelivr.net;js.nicedit.com;www.google.com;cse.google.com;cdn.syndication.twimg.com;platform.twitter.com;apis.google.com;www.google-analytics.com;www.googletagservices.com;adservice.google.com;securepubads.g.doubleclick.net;ajax.aspnetcdn.com;ssl.google-analytics.com diff --git a/source/DasBlog.Web.UI/DasBlog.Web.csproj b/source/DasBlog.Web.UI/DasBlog.Web.csproj index b4d980ea..103b3530 100644 --- a/source/DasBlog.Web.UI/DasBlog.Web.csproj +++ b/source/DasBlog.Web.UI/DasBlog.Web.csproj @@ -14,7 +14,7 @@ true Linux d3583964-0aca-4de4-9521-c74cdf42f990 - 2.40.0 + 2.41.0 diff --git a/source/DasBlog.Web.UI/Models/AdminViewModels/SiteViewModel.cs b/source/DasBlog.Web.UI/Models/AdminViewModels/SiteViewModel.cs index 28d84453..0ee03502 100644 --- a/source/DasBlog.Web.UI/Models/AdminViewModels/SiteViewModel.cs +++ b/source/DasBlog.Web.UI/Models/AdminViewModels/SiteViewModel.cs @@ -286,6 +286,11 @@ public class SiteViewModel [Description("")] public bool EnableDoubleDecode { get; set; } + [DisplayName("Default Sources (seperated by semi colon")] + [Description("")] + [StringLength(50, MinimumLength = 1, ErrorMessage = "{0} should be between 1 to 50 characters")] + public string DefaultSources { get; set; } + public bool EntryTitleAsLink { get; set; } public bool ObfuscateEmail { get; set; } public bool SendReferralsByEmail { get; set; } diff --git a/source/DasBlog.Web.UI/Startup.cs b/source/DasBlog.Web.UI/Startup.cs index 094158ff..70d1f154 100644 --- a/source/DasBlog.Web.UI/Startup.cs +++ b/source/DasBlog.Web.UI/Startup.cs @@ -386,13 +386,14 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IDasBlog var SecurityScriptSources = Configuration.GetSection("SecurityScriptSources")?.Value?.Split(";"); var SecurityStyleSources = Configuration.GetSection("SecurityStyleSources")?.Value?.Split(";"); + var DefaultSources = Configuration.GetSection("DefaultSources")?.Value?.Split(";"); - if (SecurityStyleSources != null && SecurityScriptSources != null) + if (SecurityStyleSources != null && SecurityScriptSources != null && DefaultSources != null) { app.UseCsp(options => options .DefaultSources(s => s.Self() - .CustomSources("data:") - .CustomSources("https:")) + .CustomSources(DefaultSources) + ) .StyleSources(s => s.Self() .CustomSources(SecurityStyleSources) .UnsafeInline() diff --git a/source/DasBlog.Web.UI/Themes/darkly/_Layout.cshtml b/source/DasBlog.Web.UI/Themes/darkly/_Layout.cshtml index 312b7d21..6be62f96 100644 --- a/source/DasBlog.Web.UI/Themes/darkly/_Layout.cshtml +++ b/source/DasBlog.Web.UI/Themes/darkly/_Layout.cshtml @@ -22,24 +22,23 @@ -