* Wed Feb 12 2025 Jean-Philippe Pialasse <jpp@koozali.org> 2.8.0-43.sme

- update SME11 EOL date and message [SME: 12915]

e-smith-manager.spec

@@ -4,7 +4,7 @@ Summary: e-smith manager navigation module
 %define name e-smith-manager
 Name: %{name}
 %define version 2.8.0
-%define release 40
+%define release 43
 Version: %{version}
 Release: %{release}%{?dist}
 License: GPL
@@ -24,6 +24,15 @@ Provides: server-manager
 AutoReqProv: no
 
 %changelog
+* Wed Feb 12 2025 Jean-Philippe Pialasse <jpp@koozali.org> 2.8.0-43.sme
+- update SME11 EOL date and message [SME: 12915]
+
+* Mon Dec 30 2024 Jean-Philippe Pialasse <jpp@koozali.org> 2.8.0-42.sme
+-  add CSP support [SME: 9566]
+
+* Tue Mar 26 2024 Jean-Philippe Pialasse <jpp@koozali.org> 2.8.0-41.sme
+- fix systemd service file [SME: 12556]
+
 * Tue Mar 12 2024 Jean-Philippe Pialasse <tests@pialasse.com> 2.8.0-40.sme
 - tidy rpm
 - add -g flag to gcc in order to get debugsourcefiles.list

root/etc/e-smith/templates/etc/e-smith/web/common/head.tmpl/30FrameSetup01

@@ -42,10 +42,10 @@ EOF
     use POSIX qw(strftime);
     my $curdate = strftime '%Y%m%d', localtime;
     $OUT .= qq(<div class="sme-error"><h5>
-      URGENT NOTICE: As per June 30th 2024, SME Server 10 is obsolete, and potentially INSECURE. NO support will be offered for any issue found with this installed version.
+      URGENT NOTICE: As per May 31st 2029, SME Server 11 is obsolete, and potentially INSECURE. NO support will be offered for any issue found with this installed version.
-      Please migrate IMMEDIATELY to Koozali SME Server 11 or higher version. Failure to upgrade may lead to the compromise of this server.
+      Please migrate IMMEDIATELY to Koozali SME Server 12 or higher version. Failure to upgrade may lead to the compromise of this server.
       </br>Please, consult <a href="https://wiki.koozali.org/SME_Server:Download" target="_blank">https://wiki.koozali.org/SME_Server:Download</a> to get last available version.</h5></div>) 
-      if  ( "$curdate"  >= "20240630");
+      if  ( "$curdate"  >= "20290531");
 
     $OUT;
 

root/etc/e-smith/templates/etc/httpd/conf/httpd.conf/VirtualHosts/27ManagerProxyPass

@@ -31,6 +31,14 @@
         } else {
             $OUT .= "        Require ip $localAccess\n";
         }
+
+        # any server-manager script or style added in line should be hashed and added here to run in a modern browser
+        $OUT .= "                   Header set Content-Security-Policy  \"script-src 'self' https://$virtualHost 'unsafe-hashes' "
+        ." 'sha256-bu1Wbll/1+gfjCxVn9czXKc7IhIJRjJgNFdNltH+09c=' 'sha256-MQmv1rIdRtr7sC3167eTWkTNMSq5QzWRPxhOzKUtvKg=' 'sha256-DuDis7gGgnegJBjroiLOJwY+DvfilQsYswIXb6lNE8c=' 'sha256-FengF4xZO+fXC/zBgGGYYPLtc95CEZAk+vS7A9OR64o='  ;"
+        ." style-src 'self' https://$virtualHost 'unsafe-hashes' "
+        ." 'sha256-ABT3Vs4q5dwUnsKaFzA38LnsL3426dj6CkNKRofyqjA=' 'sha256-upqzRUpu+M2pCK19HHLg5oUeQnpEXij9kojuDNdJnGc=' 'sha256-sa1JolVbZz72+sa0pOWp/LBIoZfF9P1N8Gzy5u3C3Qc=' 'sha256-q9xrwNUn7ieRndtLNP/uNCEBKXjzTzvZv1fddtmMK9w=' ;"
+        ." script-src-attr 'self' https://$virtualHost 'unsafe-hashes' 'sha256-QgFUvJuzASZ+WbF57Vn8eQoWvuBJ78nF7YMraPzQVvg=' \"\n"; 
+
         $OUT .= "    </Location>\n";
     }
 }

root/etc/e-smith/web/functions/navigation

@@ -288,6 +288,18 @@ sub showNavigation ($)
     // End script hiding -->
     </script>
     ";
+   print '    
+   <script language="JavaScript" type="text/javascript">
+   <!-- Hide script
+        window.onload = function(){
+          var menuitems = document.getElementsByClassName("item");
+	  var i = menuitems.length;
+	  while (i--)
+	    menuitems[i].addEventListener("click", function(){swapClasses(this.id)});
+	};  
+        // End script hiding -->
+    </script>
+    ';
 
     foreach my $h (sort {
 	 ($nav{$a}{'WEIGHT'}/$nav{$a}{'COUNT'}) <=>
@@ -320,7 +332,7 @@ sub showNavigation ($)
 			     $q->td ({-class => "menu-cell"},
 				     $q->a ({-id => "sme$c",
                                             -class => "item",
-                                            -onClick => "swapClasses('sme$c')",
+					    #-onClick => "swapClasses(this.id)", #with CSP replaced by eventlistener
                                             href => $href, 
                                             target => 'main'}, 
                                         $_->{'DESCRIPTION'})

root/usr/lib/systemd/system/httpd-admin.service

@@ -6,7 +6,6 @@ Documentation=man:apachectl(8)
 
 [Service]
 Type=notify
-EnvironmentFile=/etc/sysconfig/httpd
 ExecStartPre=/sbin/e-smith/service-status httpd-admin
 ExecStartPre=/sbin/e-smith/expand-template /etc/httpd/admin-conf/httpd.conf
 ExecStart=/usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -DFOREGROUND