2016-07-19 12:14:32 -05:00
|
|
|
/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4; fill-column: 100 -*- */
|
|
|
|
/*
|
|
|
|
* This file is part of the LibreOffice project.
|
|
|
|
*
|
|
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "config.h"
|
|
|
|
|
|
|
|
#include <string>
|
|
|
|
#include <vector>
|
|
|
|
|
2017-03-11 16:28:59 -06:00
|
|
|
#include <Poco/DateTime.h>
|
2017-02-27 07:28:04 -06:00
|
|
|
#include <Poco/DateTimeFormat.h>
|
|
|
|
#include <Poco/DateTimeFormatter.h>
|
2016-07-19 12:55:16 -05:00
|
|
|
#include <Poco/Exception.h>
|
2016-07-19 12:14:32 -05:00
|
|
|
#include <Poco/FileStream.h>
|
|
|
|
#include <Poco/Net/HTTPCookie.h>
|
|
|
|
#include <Poco/Net/HTTPBasicCredentials.h>
|
|
|
|
#include <Poco/Net/HTMLForm.h>
|
|
|
|
#include <Poco/Net/HTTPRequest.h>
|
2016-07-19 12:55:16 -05:00
|
|
|
#include <Poco/Net/NameValueCollection.h>
|
2016-07-19 12:14:32 -05:00
|
|
|
#include <Poco/Net/NetException.h>
|
|
|
|
#include <Poco/RegularExpression.h>
|
|
|
|
#include <Poco/Runnable.h>
|
|
|
|
#include <Poco/StreamCopier.h>
|
|
|
|
#include <Poco/StringTokenizer.h>
|
|
|
|
#include <Poco/URI.h>
|
|
|
|
|
2016-12-21 14:37:22 -06:00
|
|
|
#include "Auth.hpp"
|
2016-07-19 12:14:32 -05:00
|
|
|
#include "Common.hpp"
|
|
|
|
#include "FileServer.hpp"
|
|
|
|
#include "LOOLWSD.hpp"
|
2016-12-21 14:37:22 -06:00
|
|
|
#include "Log.hpp"
|
2016-07-19 12:14:32 -05:00
|
|
|
|
|
|
|
using Poco::FileInputStream;
|
|
|
|
using Poco::Net::HTMLForm;
|
|
|
|
using Poco::Net::HTTPRequest;
|
|
|
|
using Poco::Net::HTTPResponse;
|
2016-07-19 12:55:16 -05:00
|
|
|
using Poco::Net::NameValueCollection;
|
2016-07-19 12:14:32 -05:00
|
|
|
using Poco::Net::HTTPBasicCredentials;
|
|
|
|
using Poco::StreamCopier;
|
|
|
|
using Poco::Util::Application;
|
|
|
|
|
2017-04-10 04:34:51 -05:00
|
|
|
bool FileServerRequestHandler::isAdminLoggedIn(const HTTPRequest& request,
|
|
|
|
HTTPResponse &response)
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
|
|
|
const auto& config = Application::instance().config();
|
|
|
|
const auto sslKeyPath = config.getString("ssl.key_file_path", "");
|
|
|
|
|
2016-07-19 12:55:16 -05:00
|
|
|
NameValueCollection cookies;
|
|
|
|
request.getCookies(cookies);
|
|
|
|
try
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
2016-07-19 12:55:16 -05:00
|
|
|
const std::string jwtToken = cookies.get("jwt");
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_INF("Verifying JWT token: " << jwtToken);
|
2016-07-19 12:14:32 -05:00
|
|
|
JWTAuth authAgent(sslKeyPath, "admin", "admin", "admin");
|
|
|
|
if (authAgent.verify(jwtToken))
|
|
|
|
{
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_TRC("JWT token is valid");
|
2016-07-19 12:14:32 -05:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_INF("Invalid JWT token, let the administrator re-login");
|
2016-07-19 12:14:32 -05:00
|
|
|
}
|
2016-07-19 12:55:16 -05:00
|
|
|
catch (const Poco::Exception& exc)
|
|
|
|
{
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_INF("No existing JWT cookie found");
|
2016-07-19 12:55:16 -05:00
|
|
|
}
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2016-07-19 12:55:16 -05:00
|
|
|
// If no cookie found, or is invalid, let admin re-login
|
2016-07-19 12:14:32 -05:00
|
|
|
const auto user = config.getString("admin_console.username", "");
|
|
|
|
const auto pass = config.getString("admin_console.password", "");
|
|
|
|
if (user.empty() || pass.empty())
|
|
|
|
{
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_ERR("Admin Console credentials missing. Denying access until set.");
|
2016-07-19 12:14:32 -05:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
HTTPBasicCredentials credentials(request);
|
|
|
|
if (credentials.getUsername() == user &&
|
|
|
|
credentials.getPassword() == pass)
|
|
|
|
{
|
|
|
|
const std::string htmlMimeType = "text/html";
|
|
|
|
// generate and set the cookie
|
|
|
|
JWTAuth authAgent(sslKeyPath, "admin", "admin", "admin");
|
|
|
|
const std::string jwtToken = authAgent.getAccessToken();
|
2017-03-13 16:48:19 -05:00
|
|
|
|
2016-07-19 12:14:32 -05:00
|
|
|
Poco::Net::HTTPCookie cookie("jwt", jwtToken);
|
2017-03-16 11:44:27 -05:00
|
|
|
// bundlify appears to add an extra /dist -> dist/dist/admin
|
|
|
|
cookie.setPath("/loleaflet/dist/");
|
|
|
|
cookie.setSecure(LOOLWSD::isSSLEnabled() ||
|
|
|
|
LOOLWSD::isSSLTermination());
|
2016-07-19 12:14:32 -05:00
|
|
|
response.addCookie(cookie);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_INF("Wrong admin credentials.");
|
2016-07-19 12:14:32 -05:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2017-03-13 16:48:19 -05:00
|
|
|
void FileServerRequestHandler::handleRequest(const HTTPRequest& request, Poco::MemoryInputStream& message,
|
|
|
|
const std::shared_ptr<StreamSocket>& socket)
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
|
|
|
try
|
|
|
|
{
|
2017-03-13 16:48:19 -05:00
|
|
|
bool noCache = false;
|
|
|
|
Poco::Net::HTTPResponse response;
|
2017-04-10 04:34:51 -05:00
|
|
|
Poco::URI requestUri(request.getURI());
|
|
|
|
LOG_TRC("Fileserver request: " << requestUri.toString());
|
|
|
|
requestUri.normalize(); // avoid .'s and ..'s
|
|
|
|
|
|
|
|
std::vector<std::string> requestSegments;
|
|
|
|
requestUri.getPathSegments(requestSegments);
|
|
|
|
if (requestSegments.size() < 1)
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
2017-04-10 04:34:51 -05:00
|
|
|
throw Poco::FileNotFoundException("Invalid URI request: [" + requestUri.toString() + "].");
|
2016-07-19 12:14:32 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
const auto& config = Application::instance().config();
|
|
|
|
const std::string loleafletHtml = config.getString("loleaflet_html", "loleaflet.html");
|
2017-04-10 04:34:51 -05:00
|
|
|
const std::string endPoint = requestSegments[requestSegments.size() - 1];
|
|
|
|
if (endPoint == loleafletHtml)
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
2017-04-10 04:34:51 -05:00
|
|
|
preprocessFile(request, message, socket);
|
2016-07-19 12:14:32 -05:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (request.getMethod() == HTTPRequest::HTTP_GET)
|
|
|
|
{
|
2017-04-10 04:34:51 -05:00
|
|
|
if (endPoint == "admin.html" ||
|
|
|
|
endPoint == "adminSettings.html" ||
|
|
|
|
endPoint == "adminAnalytics.html")
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
2017-03-13 16:48:19 -05:00
|
|
|
noCache = true;
|
|
|
|
|
2017-04-10 04:34:51 -05:00
|
|
|
if (!FileServerRequestHandler::isAdminLoggedIn(request, response))
|
2016-07-19 12:14:32 -05:00
|
|
|
throw Poco::Net::NotAuthenticatedException("Invalid admin login");
|
2017-04-09 12:26:37 -05:00
|
|
|
|
|
|
|
// Ask UAs to block if they detect any XSS attempt
|
|
|
|
response.add("X-XSS-Protection", "1; mode=block");
|
2017-04-10 07:57:07 -05:00
|
|
|
// No referrer-policy
|
|
|
|
response.add("Referrer-Policy", "no-referrer");
|
2016-07-19 12:14:32 -05:00
|
|
|
}
|
|
|
|
|
2017-04-10 04:34:51 -05:00
|
|
|
const auto path = Poco::Path(LOOLWSD::FileServerRoot, getRequestPathname(request));
|
|
|
|
const auto filepath = path.absolute().toString();
|
|
|
|
if (filepath.find(LOOLWSD::FileServerRoot) != 0)
|
|
|
|
{
|
|
|
|
// Accessing unauthorized path.
|
|
|
|
throw Poco::FileAccessDeniedException("Invalid or forbidden file path: [" + filepath + "].");
|
|
|
|
}
|
|
|
|
|
|
|
|
const std::size_t extPoint = endPoint.find_last_of('.');
|
|
|
|
if (extPoint == std::string::npos)
|
|
|
|
{
|
|
|
|
throw Poco::FileNotFoundException("Invalid file.");
|
|
|
|
}
|
|
|
|
|
|
|
|
const std::string fileType = endPoint.substr(extPoint + 1);
|
2016-07-19 12:14:32 -05:00
|
|
|
std::string mimeType;
|
|
|
|
if (fileType == "js")
|
|
|
|
mimeType = "application/javascript";
|
|
|
|
else if (fileType == "css")
|
|
|
|
mimeType = "text/css";
|
|
|
|
else if (fileType == "html")
|
|
|
|
mimeType = "text/html";
|
|
|
|
else if (fileType == "svg")
|
|
|
|
mimeType = "image/svg+xml";
|
|
|
|
else
|
|
|
|
mimeType = "text/plain";
|
|
|
|
|
2017-03-11 16:28:59 -06:00
|
|
|
auto it = request.find("If-None-Match");
|
|
|
|
if (it != request.end())
|
|
|
|
{
|
|
|
|
// if ETags match avoid re-sending the file.
|
2017-04-12 06:46:09 -05:00
|
|
|
if (!noCache && it->second == "\"" LOOLWSD_VERSION_HASH "\"")
|
2017-03-11 16:28:59 -06:00
|
|
|
{
|
|
|
|
// TESTME: harder ... - do we even want ETag support ?
|
|
|
|
std::ostringstream oss;
|
|
|
|
Poco::Timestamp nowTs;
|
|
|
|
Poco::DateTime now(nowTs);
|
|
|
|
Poco::DateTime later(now.utcTime(), int64_t(1000)*1000 * 60 * 60 * 24 * 128);
|
|
|
|
oss << "HTTP/1.1 304 Not Modified\r\n"
|
|
|
|
<< "Date: " << Poco::DateTimeFormatter::format(
|
|
|
|
now, Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
|
|
|
<< "Expires: " << Poco::DateTimeFormatter::format(
|
|
|
|
later, Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
|
|
|
<< "User-Agent: LOOLWSD WOPI Agent\r\n"
|
|
|
|
<< "Cache-Control: max-age=11059200\r\n"
|
|
|
|
<< "\r\n";
|
2017-03-13 18:38:19 -05:00
|
|
|
socket->send(oss.str());
|
2017-03-11 16:28:59 -06:00
|
|
|
socket->shutdown();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-03-19 10:45:29 -05:00
|
|
|
bool deflate = request.hasToken("Accept-Encoding", "deflate");
|
2017-04-10 04:34:51 -05:00
|
|
|
HttpHelper::sendFile(socket, filepath, mimeType, response, noCache, deflate);
|
2016-07-19 12:14:32 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
catch (const Poco::Net::NotAuthenticatedException& exc)
|
|
|
|
{
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_ERR("FileServerRequestHandler::NotAuthenticated: " << exc.displayText());
|
2017-02-27 07:37:48 -06:00
|
|
|
|
|
|
|
// Unauthorized.
|
|
|
|
std::ostringstream oss;
|
|
|
|
oss << "HTTP/1.1 401\r\n"
|
2017-02-27 07:40:44 -06:00
|
|
|
<< "Date: " << Poco::DateTimeFormatter::format(Poco::Timestamp(), Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
2017-02-27 07:37:48 -06:00
|
|
|
<< "User-Agent: LOOLWSD WOPI Agent\r\n"
|
|
|
|
<< "Content-Length: 0\r\n"
|
|
|
|
<< "WWW-Authenticate: Basic realm=\"online\"\r\n"
|
|
|
|
<< "\r\n";
|
2017-03-13 18:38:19 -05:00
|
|
|
socket->send(oss.str());
|
2016-07-19 12:14:32 -05:00
|
|
|
}
|
|
|
|
catch (const Poco::FileAccessDeniedException& exc)
|
|
|
|
{
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_ERR("FileServerRequestHandler: " << exc.displayText());
|
2017-02-27 07:37:48 -06:00
|
|
|
|
|
|
|
// TODO return some 403 page?
|
|
|
|
std::ostringstream oss;
|
|
|
|
oss << "HTTP/1.1 403\r\n"
|
2017-02-27 07:40:44 -06:00
|
|
|
<< "Date: " << Poco::DateTimeFormatter::format(Poco::Timestamp(), Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
2017-02-27 07:37:48 -06:00
|
|
|
<< "User-Agent: LOOLWSD WOPI Agent\r\n"
|
|
|
|
<< "Content-Length: 0\r\n"
|
|
|
|
<< "\r\n";
|
2017-03-13 18:38:19 -05:00
|
|
|
socket->send(oss.str());
|
2016-07-19 12:14:32 -05:00
|
|
|
}
|
|
|
|
catch (const Poco::FileNotFoundException& exc)
|
|
|
|
{
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_ERR("FileServerRequestHandler: " << exc.displayText());
|
2017-02-27 07:37:48 -06:00
|
|
|
|
|
|
|
// 404 not found
|
|
|
|
std::ostringstream oss;
|
|
|
|
oss << "HTTP/1.1 404\r\n"
|
2017-02-27 07:40:44 -06:00
|
|
|
<< "Date: " << Poco::DateTimeFormatter::format(Poco::Timestamp(), Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
2017-02-27 07:37:48 -06:00
|
|
|
<< "User-Agent: LOOLWSD WOPI Agent\r\n"
|
|
|
|
<< "Content-Length: 0\r\n"
|
|
|
|
<< "\r\n";
|
2017-03-13 18:38:19 -05:00
|
|
|
socket->send(oss.str());
|
2016-07-19 12:14:32 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-02-27 07:28:04 -06:00
|
|
|
std::string FileServerRequestHandler::getRequestPathname(const HTTPRequest& request)
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
|
|
|
Poco::URI requestUri(request.getURI());
|
|
|
|
// avoid .'s and ..'s
|
|
|
|
requestUri.normalize();
|
|
|
|
|
|
|
|
std::string path(requestUri.getPath());
|
|
|
|
|
2017-04-10 04:34:51 -05:00
|
|
|
// Convert version back to a real file name. Remove first foreslash as the root ends in one.
|
|
|
|
Poco::replaceInPlace(path, std::string("/loleaflet/" LOOLWSD_VERSION_HASH "/"), std::string("loleaflet/dist/"));
|
2016-07-19 12:14:32 -05:00
|
|
|
|
|
|
|
return path;
|
|
|
|
}
|
|
|
|
|
2017-04-10 04:34:51 -05:00
|
|
|
void FileServerRequestHandler::preprocessFile(const HTTPRequest& request, Poco::MemoryInputStream& message, const std::shared_ptr<StreamSocket>& socket)
|
2016-07-19 12:14:32 -05:00
|
|
|
{
|
2016-08-29 00:23:37 -05:00
|
|
|
const auto host = ((LOOLWSD::isSSLEnabled() || LOOLWSD::isSSLTermination()) ? "wss://" : "ws://") + (LOOLWSD::ServerName.empty() ? request.getHost() : LOOLWSD::ServerName);
|
2017-04-07 01:23:43 -05:00
|
|
|
const auto params = Poco::URI(request.getURI()).getQueryParameters();
|
|
|
|
std::string wopiDomain;
|
|
|
|
for (const auto& param : params)
|
|
|
|
{
|
|
|
|
if (param.first == "WOPISrc")
|
|
|
|
{
|
|
|
|
std::string wopiHost;
|
|
|
|
Poco::URI::decode(param.second, wopiHost);
|
|
|
|
wopiDomain = Poco::URI(wopiHost).getScheme() + "://" + Poco::URI(wopiHost).getHost();
|
|
|
|
}
|
|
|
|
}
|
2016-07-27 23:56:09 -05:00
|
|
|
const auto path = Poco::Path(LOOLWSD::FileServerRoot, getRequestPathname(request));
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_DBG("Preprocessing file: " << path.toString());
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2016-07-29 07:42:43 -05:00
|
|
|
if (!Poco::File(path).exists())
|
|
|
|
{
|
2016-12-19 17:24:03 -06:00
|
|
|
LOG_ERR("File [" << path.toString() << "] does not exist.");
|
2017-02-27 07:37:48 -06:00
|
|
|
|
|
|
|
// 404 not found
|
|
|
|
std::ostringstream oss;
|
|
|
|
oss << "HTTP/1.1 404\r\n"
|
2017-02-27 07:40:44 -06:00
|
|
|
<< "Date: " << Poco::DateTimeFormatter::format(Poco::Timestamp(), Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
2017-02-27 07:37:48 -06:00
|
|
|
<< "User-Agent: LOOLWSD WOPI Agent\r\n"
|
|
|
|
<< "Content-Length: 0\r\n"
|
|
|
|
<< "\r\n";
|
2017-03-13 18:38:19 -05:00
|
|
|
socket->send(oss.str());
|
2016-07-29 07:42:43 -05:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2016-07-27 23:56:09 -05:00
|
|
|
std::string preprocess;
|
|
|
|
FileInputStream file(path.toString());
|
|
|
|
StreamCopier::copyToString(file, preprocess);
|
|
|
|
file.close();
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2017-02-27 21:38:18 -06:00
|
|
|
HTMLForm form(request, message);
|
|
|
|
const std::string& accessToken = form.get("access_token", "");
|
|
|
|
const std::string& accessTokenTtl = form.get("access_token_ttl", "");
|
|
|
|
LOG_TRC("access_token=" << accessToken << ", access_token_ttl=" << accessTokenTtl);
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2016-11-15 08:51:02 -06:00
|
|
|
// Escape bad characters in access token.
|
|
|
|
// This is placed directly in javascript in loleaflet.html, we need to make sure
|
|
|
|
// that no one can do anything nasty with their clever inputs.
|
|
|
|
std::string escapedAccessToken;
|
|
|
|
Poco::URI::encode(accessToken, "'", escapedAccessToken);
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2016-11-29 09:47:18 -06:00
|
|
|
unsigned long tokenTtl = 0;
|
2016-12-13 02:55:31 -06:00
|
|
|
if (accessToken != "")
|
2016-11-29 09:47:18 -06:00
|
|
|
{
|
2016-12-13 02:55:31 -06:00
|
|
|
if (accessTokenTtl != "")
|
2016-12-12 12:28:37 -06:00
|
|
|
{
|
2016-12-13 02:55:31 -06:00
|
|
|
try
|
|
|
|
{
|
|
|
|
tokenTtl = std::stoul(accessTokenTtl);
|
|
|
|
}
|
|
|
|
catch(const std::exception& exc)
|
|
|
|
{
|
|
|
|
LOG_ERR("access_token_ttl must be represented as the number of milliseconds since January 1, 1970 UTC, when the token will expire");
|
|
|
|
}
|
2016-12-12 12:28:37 -06:00
|
|
|
}
|
2016-12-13 02:55:31 -06:00
|
|
|
else
|
2016-12-12 12:28:37 -06:00
|
|
|
{
|
2016-12-13 02:55:31 -06:00
|
|
|
LOG_WRN("WOPI host did not pass optional access_token_ttl");
|
2016-12-12 12:28:37 -06:00
|
|
|
}
|
2016-11-29 09:47:18 -06:00
|
|
|
}
|
|
|
|
|
2016-11-15 08:51:02 -06:00
|
|
|
Poco::replaceInPlace(preprocess, std::string("%ACCESS_TOKEN%"), escapedAccessToken);
|
2016-11-29 09:47:18 -06:00
|
|
|
Poco::replaceInPlace(preprocess, std::string("%ACCESS_TOKEN_TTL%"), std::to_string(tokenTtl));
|
2016-07-27 23:56:09 -05:00
|
|
|
Poco::replaceInPlace(preprocess, std::string("%HOST%"), host);
|
|
|
|
Poco::replaceInPlace(preprocess, std::string("%VERSION%"), std::string(LOOLWSD_VERSION_HASH));
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2016-12-15 03:56:54 -06:00
|
|
|
const auto& config = Application::instance().config();
|
|
|
|
const auto loleafletLogging = config.getString("loleaflet_logging", "false");
|
|
|
|
Poco::replaceInPlace(preprocess, std::string("%LOLEAFLET_LOGGING%"), loleafletLogging);
|
|
|
|
|
2017-02-27 07:28:04 -06:00
|
|
|
const std::string mimeType = "text/html";
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2017-02-27 07:28:04 -06:00
|
|
|
std::ostringstream oss;
|
|
|
|
oss << "HTTP/1.1 200 OK\r\n"
|
2017-02-27 07:40:44 -06:00
|
|
|
<< "Date: " << Poco::DateTimeFormatter::format(Poco::Timestamp(), Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
2017-02-27 07:28:04 -06:00
|
|
|
<< "Last-Modified: " << Poco::DateTimeFormatter::format(Poco::Timestamp(), Poco::DateTimeFormat::HTTP_FORMAT) << "\r\n"
|
|
|
|
<< "User-Agent: LOOLWSD WOPI Agent\r\n"
|
2017-03-10 10:42:48 -06:00
|
|
|
<< "Cache-Control:max-age=11059200\r\n"
|
|
|
|
<< "ETag: \"" LOOLWSD_VERSION_HASH "\"\r\n"
|
2017-02-27 07:28:04 -06:00
|
|
|
<< "Content-Length: " << preprocess.size() << "\r\n"
|
2017-04-09 10:48:05 -05:00
|
|
|
<< "Content-Type: " << mimeType << "\r\n"
|
2017-04-09 12:26:37 -05:00
|
|
|
<< "X-Content-Type-Options: nosniff\r\n"
|
2017-04-10 07:57:07 -05:00
|
|
|
<< "X-XSS-Protection: 1; mode=block\r\n"
|
|
|
|
<< "Referrer-Policy: no-referrer\r\n";
|
2017-04-07 01:23:43 -05:00
|
|
|
|
|
|
|
if (!wopiDomain.empty())
|
2017-04-07 04:38:38 -05:00
|
|
|
{
|
2017-04-09 13:23:45 -05:00
|
|
|
oss << "X-Frame-Options: allow-from " << wopiDomain << "\r\n";
|
|
|
|
oss << "Content-Security-Policy: frame-ancestors " << wopiDomain << "\r\n";
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
oss << "X-Frame-Options: deny\r\n";
|
2017-04-07 04:38:38 -05:00
|
|
|
}
|
2017-04-07 01:23:43 -05:00
|
|
|
|
2017-04-10 03:12:29 -05:00
|
|
|
// Setup HTTP Public key pinning
|
|
|
|
if (LOOLWSD::isSSLEnabled() && config.getBool("ssl.hpkp[@enable]", false))
|
|
|
|
{
|
|
|
|
size_t i = 0;
|
|
|
|
std::string pinPath = "ssl.hpkp.pins.pin[" + std::to_string(i) + "]";
|
|
|
|
std::ostringstream hpkpOss;
|
|
|
|
bool keysPinned = false;
|
|
|
|
while (config.has(pinPath))
|
|
|
|
{
|
|
|
|
const auto pin = config.getString(pinPath, "");
|
|
|
|
if (!pin.empty())
|
|
|
|
{
|
|
|
|
hpkpOss << "pin-sha256=\"" << pin << "\"; ";
|
|
|
|
keysPinned = true;
|
|
|
|
}
|
|
|
|
pinPath = "ssl.hpkp.pins.pin[" + std::to_string(++i) + "]";
|
|
|
|
}
|
|
|
|
|
|
|
|
if (keysPinned && config.getBool("ssl.hpkp.max_age[@enable]", false))
|
|
|
|
{
|
|
|
|
int maxAge = 1000; // seconds
|
|
|
|
try
|
|
|
|
{
|
|
|
|
maxAge = config.getInt("ssl.hpkp.max_age", maxAge);
|
|
|
|
}
|
|
|
|
catch (Poco::SyntaxException& exc)
|
|
|
|
{
|
|
|
|
LOG_WRN("Invalid value of HPKP's max-age directive found in config file. Defaulting to "
|
|
|
|
<< maxAge);
|
|
|
|
}
|
|
|
|
hpkpOss << "max-age=" << maxAge << "; ";
|
|
|
|
}
|
|
|
|
|
|
|
|
if (keysPinned && config.getBool("ssl.hpkp.report_uri[@enable]", false))
|
|
|
|
{
|
|
|
|
const std::string reportUri = config.getString("ssl.hpkp.report_uri", "");
|
|
|
|
if (!reportUri.empty())
|
|
|
|
{
|
|
|
|
hpkpOss << "report-uri=" << reportUri << "; ";
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!hpkpOss.str().empty())
|
|
|
|
{
|
|
|
|
if (config.getBool("ssl.hpkp[@report_only]", false))
|
|
|
|
{
|
|
|
|
// Only send validation failure reports to reportUri while still allowing UAs to
|
|
|
|
// connect to the server
|
|
|
|
oss << "Public-Key-Pins-Report-Only: " << hpkpOss.str() << "\r\n";
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
oss << "Public-Key-Pins: " << hpkpOss.str() << "\r\n";
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-04-07 01:23:43 -05:00
|
|
|
oss << "\r\n"
|
2017-02-27 07:28:04 -06:00
|
|
|
<< preprocess;
|
2016-07-19 12:14:32 -05:00
|
|
|
|
2017-03-13 18:38:19 -05:00
|
|
|
socket->send(oss.str());
|
2017-02-27 20:35:06 -06:00
|
|
|
LOG_DBG("Sent file: " << path.toString() << ": " << preprocess);
|
2016-07-28 03:24:25 -05:00
|
|
|
}
|
|
|
|
|
2016-07-19 12:14:32 -05:00
|
|
|
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
|