acs-bootstrap-installer

  • last updated 56 mins ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Improve spelling

  1. … 8 more files in changeset.
Fix spelling errors, use OpenACS

    • -3
    • +3
    ./tcl/40-db-query-dispatcher-procs.tcl
Fix spelling errors

  1. … 10 more files in changeset.
- Tcl idioms: simplify access to first character

  1. … 8 more files in changeset.
Improve robustness of file operations against names starting with a "-"

  1. … 8 more files in changeset.
- bump version number of OpenACS to 5.9.1b3 and DotLRN to 2.9.1b3

  1. … 79 more files in changeset.
Ease debugging

Bump version numbers for OpenACS 5.9.1b1

  1. … 81 more files in changeset.
- remove circular dependency

- modernize tcl

    • -13
    • +3
    ./tcl/40-db-query-dispatcher-procs.tcl
- remove unneeded braces

Put CSP stuff in the installer page only when required (an error is thrown and we need the back button)

In such case, make the nonce attribute safer by using the proc instead of the (likely missing) variable

Removed inline event handlers to comply with CSP

- improve HTML quoting

- replace onchange handler in installer by event listeners (just for the sake of completeness)

- make sure to call template::head::prepare_multirows after all body_scripts are created

- bump version to 5.9.1d6

- remove unneeded expr statements

  1. … 5 more files in changeset.
- copy the body of ad_get_tcl_call_stack from acs-tcl/tcl/utilities-procs to achive consistent behavior, when acs-bootstrap installer is reloaded.

Fixed typo: kernel_id instead of $::acs::kernel_id, not yet defined.

bootstrap installer:

- added csp policy to the files upgradeable via apm

- bumped version number to 5.9.1d5

    • -0
    • +2
    ./installer/www/SYSTEM/csp-collector.tcl
  1. … 1 more file in changeset.
file csp-collector.tcl was initially added on branch oacs-5-9.

    • -0
    • +0
    ./installer/www/SYSTEM/csp-collector.tcl
- use subst instead of doublequotes

-- handle ie 11 (uses a different header field for CSP)

- move CSP generation to the end

    • -16
    • +23
    ./installer/www/blank-master.tcl
  1. … 1 more file in changeset.
- setting namespaced variable ::acs::kernel_id for future use

- Refine security policies: when necessary, define both a nonce and a

'unsafe-inline' to ensure compatibility on some less adavanced

browsers

- use same "secure" setting for ad_session_id, otherwise, just the

last one is honored

- fix linefeed and semicolon in js for focus handling

  1. … 2 more files in changeset.
- add CSP nonce to script tags if nonce value is available

- turn function definition of acs_Focus() into a conditionally defined

body-script

- turn "body_event_handlers" into "window.addEventListener"

    • -20
    • +23
    ./installer/www/blank-master.tcl
  1. … 3 more files in changeset.
- Added support for W3C Content Security Policy(CSP)

* For details about CSP, see https://www.w3.org/TR/CSP/

* New calls:

security::csp::nonce:

Generate a CSP nonce token token

security::csp::require /directive/ /value/:

Add a requirements of a page to the CSP in order to generate

later a tailored policy with the minimal permissions for

this page. For example, the following requirement is

currently added per default to the oacs-master template to

permit style tags and style attribites in the markup.

security::csp::require style-src 'unsafe-inline'

security::csp::render:

Generate a policy from the requirements

* Added Kernel Parameter CSPEnabledP to activate/desctivate CSP

(default on)

- Bump version numbers

acs-tcl to 5.9.1d11

acs-bootstrap-installer to 5.9.1d4

acs-kernel to 5.9.1d17

  1. … 5 more files in changeset.
- add support for W3C Subresource Integrity (SRI)

* For details about SRI, see https://www.w3.org/TR/SRI/

* Added arguments -crossorigin and -integrity

to the following functions

template::add_body_script

template::add_script

template::head::add_javascript

template::head::add_link

template::head::add_script

* Updated blank-master.adp

- some more cleanup:

* remove commented out code

* add missing argument documentation

(template::head::add_javascript)

* document arguments alphabetically

  1. … 2 more files in changeset.
- improve debug messages for broken installations

  1. … 1 more file in changeset.
- add dependency problems to error.log as well