* Mon Dec 30 2024 Jean-Philippe Pialasse <jpp@koozali.org> 2.8.0-42.sme

-  add CSP support [SME: 9566]

e-smith-manager.spec

@@ -4,7 +4,7 @@ Summary: e-smith manager navigation module
 %define name e-smith-manager
 Name: %{name}
 %define version 2.8.0
-%define release 39
+%define release 42
 Version: %{version}
 Release: %{release}%{?dist}
 License: GPL
@@ -24,6 +24,16 @@ Provides: server-manager
 AutoReqProv: no
 
 %changelog
+* Mon Dec 30 2024 Jean-Philippe Pialasse <jpp@koozali.org> 2.8.0-42.sme
+-  add CSP support [SME: 9566]
+
+* Tue Mar 26 2024 Jean-Philippe Pialasse <jpp@koozali.org> 2.8.0-41.sme
+- fix systemd service file [SME: 12556]
+
+* Tue Mar 12 2024 Jean-Philippe Pialasse <tests@pialasse.com> 2.8.0-40.sme
+- tidy rpm
+- add -g flag to gcc in order to get debugsourcefiles.list
+
 * Mon Aug 07 2023 cvs2git.sh aka Brian Read <brianr@koozali.org> 2.8.0-39.sme
 - Roll up patches and move to git repo [SME: 12338]
 
@@ -786,7 +796,7 @@ rm -rf root/var/service
 
 %build
 perl createlinks
-gcc -o root/etc/e-smith/web/functions/wrapper manager.c
+gcc -g -o root/etc/e-smith/web/functions/wrapper manager.c
 mkdir -p root/home/e-smith/db/navigation
 mkdir -p root/etc/e-smith/web/common/css
 
@@ -809,21 +819,6 @@ mkdir -p root/etc/e-smith/web/panels/manager/{cgi-bin,html}
 mkdir -p root/etc/e-smith/web/panels/password/{cgi-bin,html}
 mkdir -p root/etc/httpd/admin-conf
 
-mkdir -p root/service
-#mkdir -p root/etc/rc.d/init.d/supervise
-#for service in httpd-admin
-#do
-#  ln -s /var/service/$service root/service/$service
-#  mkdir -p root/var/service/$service/supervise
-#  touch root/var/service/$service/down
-#  if [ -d root/var/service/$service/log ]
-#  then
-#    mkdir -p root/var/service/$service/log/supervise
-#    mkdir -p root/var/log/$service
-#  fi
-#  ln -s ../daemontools root/etc/rc.d/init.d/supervise/$service
-#done
-
 %install
 rm -rf $RPM_BUILD_ROOT
 (cd root ; find . -depth -print | cpio -dump $RPM_BUILD_ROOT)
@@ -840,12 +835,6 @@ echo "%doc COPYING" >> %{name}-%{version}-%{release}-filelist
 rm -rf $RPM_BUILD_ROOT
 
 %pre
-if [ $1 -gt 1 ] ; then
-  if [ -e /var/service/httpd-admin/run ] ; then
-       /usr/bin/sv d httpd-admin
-       /usr/bin/sv d httpd-admin/log
-  fi
-fi
 %preun
 %post
 find /etc/e-smith/web/panels/manager/cgi-bin/ -type f | \
@@ -853,10 +842,6 @@ find /etc/e-smith/web/panels/manager/cgi-bin/ -type f | \
     xargs grep -l Persisten | \
     xargs rm -f
 
-if [ -d /var/service/httpd-admin ] ; then
-   rm -rf /var/service/httpd-admin
-fi
-
 %postun
 
 %files -f %{name}-%{version}-%{release}-filelist

root/etc/e-smith/templates/etc/httpd/conf/httpd.conf/VirtualHosts/27ManagerProxyPass

@@ -31,6 +31,14 @@
         } else {
             $OUT .= "        Require ip $localAccess\n";
         }
+
+        # any server-manager script or style added in line should be hashed and added here to run in a modern browser
+        $OUT .= "                   Header set Content-Security-Policy  \"script-src 'self' https://$virtualHost 'unsafe-hashes' "
+        ." 'sha256-bu1Wbll/1+gfjCxVn9czXKc7IhIJRjJgNFdNltH+09c=' 'sha256-MQmv1rIdRtr7sC3167eTWkTNMSq5QzWRPxhOzKUtvKg=' 'sha256-DuDis7gGgnegJBjroiLOJwY+DvfilQsYswIXb6lNE8c=' 'sha256-FengF4xZO+fXC/zBgGGYYPLtc95CEZAk+vS7A9OR64o='  ;"
+        ." style-src 'self' https://$virtualHost 'unsafe-hashes' "
+        ." 'sha256-ABT3Vs4q5dwUnsKaFzA38LnsL3426dj6CkNKRofyqjA=' 'sha256-upqzRUpu+M2pCK19HHLg5oUeQnpEXij9kojuDNdJnGc=' 'sha256-sa1JolVbZz72+sa0pOWp/LBIoZfF9P1N8Gzy5u3C3Qc=' 'sha256-q9xrwNUn7ieRndtLNP/uNCEBKXjzTzvZv1fddtmMK9w=' ;"
+        ." script-src-attr 'self' https://$virtualHost 'unsafe-hashes' 'sha256-QgFUvJuzASZ+WbF57Vn8eQoWvuBJ78nF7YMraPzQVvg=' \"\n"; 
+
         $OUT .= "    </Location>\n";
     }
 }

root/etc/e-smith/web/functions/navigation

@@ -288,6 +288,18 @@ sub showNavigation ($)
     // End script hiding -->
     </script>
     ";
+   print '    
+   <script language="JavaScript" type="text/javascript">
+   <!-- Hide script
+        window.onload = function(){
+          var menuitems = document.getElementsByClassName("item");
+	  var i = menuitems.length;
+	  while (i--)
+	    menuitems[i].addEventListener("click", function(){swapClasses(this.id)});
+	};  
+        // End script hiding -->
+    </script>
+    ';
 
     foreach my $h (sort {
 	 ($nav{$a}{'WEIGHT'}/$nav{$a}{'COUNT'}) <=>
@@ -320,7 +332,7 @@ sub showNavigation ($)
 			     $q->td ({-class => "menu-cell"},
 				     $q->a ({-id => "sme$c",
                                             -class => "item",
-                                            -onClick => "swapClasses('sme$c')",
+					    #-onClick => "swapClasses(this.id)", #with CSP replaced by eventlistener
                                             href => $href, 
                                             target => 'main'}, 
                                         $_->{'DESCRIPTION'})

root/usr/lib/systemd/system/httpd-admin.service

@@ -6,7 +6,6 @@ Documentation=man:apachectl(8)
 
 [Service]
 Type=notify
-EnvironmentFile=/etc/sysconfig/httpd
 ExecStartPre=/sbin/e-smith/service-status httpd-admin
 ExecStartPre=/sbin/e-smith/expand-template /etc/httpd/admin-conf/httpd.conf
 ExecStart=/usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -DFOREGROUND