• last updated 22 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
-- handle ie 11 (uses a different header field for CSP)

- move CSP generation to the end

  1. … 1 more file in changeset.
- Refine security policies: when necessary, define both a nonce and a

'unsafe-inline' to ensure compatibility on some less adavanced

browsers

- use same "secure" setting for ad_session_id, otherwise, just the

last one is honored

- fix linefeed and semicolon in js for focus handling

  1. … 2 more files in changeset.
- add CSP nonce to script tags if nonce value is available

- turn function definition of acs_Focus() into a conditionally defined

body-script

- turn "body_event_handlers" into "window.addEventListener"

  1. … 4 more files in changeset.
- Added support for W3C Content Security Policy(CSP)

* For details about CSP, see https://www.w3.org/TR/CSP/

* New calls:

security::csp::nonce:

Generate a CSP nonce token token

security::csp::require /directive/ /value/:

Add a requirements of a page to the CSP in order to generate

later a tailored policy with the minimal permissions for

this page. For example, the following requirement is

currently added per default to the oacs-master template to

permit style tags and style attribites in the markup.

security::csp::require style-src 'unsafe-inline'

security::csp::render:

Generate a policy from the requirements

* Added Kernel Parameter CSPEnabledP to activate/desctivate CSP

(default on)

- Bump version numbers

acs-tcl to 5.9.1d11

acs-bootstrap-installer to 5.9.1d4

acs-kernel to 5.9.1d17

  1. … 7 more files in changeset.
- bring version in www (in cvs) in sync with version from packages/acs-bootstrap-installer/installer/www/

- regenerated documentation, including changelog

  1. … 123 more files in changeset.
- added version info

- update for js and flat list support

- improve validity for HTML5

  1. … 1 more file in changeset.
- provide minimal support for ckeditor4 (via CDN)

- added changes from antonio to pass handling for unknown editor to the master templates

  1. … 2 more files in changeset.
- provide defaults for Content-Style-Type and Content-Script-Type

  1. … 1 more file in changeset.
- stick in oacs-5-8 to the old praxis and load core.js in oacs-5-9 as body script

- include js function acs_Focus() in head such that core.js can be

added safely as body_script

- remove obsolete handling for document.getElementById()

  1. … 1 more file in changeset.
Merging back to HEAD all changes that happened in branch oacs-5-8 between tags: vg-merge-oacs-5-8-from-20141027 and vg-merge-oacs-5-8-from-20150427

  1. … 520 more files in changeset.
- Moved core.js inclusion to bottom of the page to comply with web best practices

- Placed warnings for other non trivial cases of big js inclusion in the head

See http://www.openacs.org/forums/message-view?message_id=4266252

Merging back to HEAD branch oacs-5-8 (using tag vg-merge-oacs-5-8-from-20141027).

  1. … 2547 more files in changeset.
- use expand operator instead of eval

- simplify logic

- use ::acs::rootdir variable instead of call

- use "![info exists]" instead of "template::util::is_nil" on scalars

  1. … 3 more files in changeset.
Merged oacs-5-6 to HEAD. HEAD now installs and passes all core tests. There

may still be some lingering problems due to my screwing up the oacs-5-6

branch earlier, I'll be looking into this later.

  1. … 214 more files in changeset.
removing OpenGraph from default implementation, moving side-bar to ecommerce

  1. … 4 more files in changeset.
adding packages/acs-subsite/lib/share-bar for share links example.

  1. … 2 more files in changeset.
adding OpenGraph protocol default generations for social networking

  1. … 1 more file in changeset.
Fixed the acs-developer-support css edit feature, by moving the calls to

generate footer and header html in front of the call to

template::head::prepare_multirow (which unsets them as they're processed).

If a footer or header template calls blank-master, this won't work, but

that will be the least of the problems to worry about in this case!

params variable was accumulating parameters from previous calls to template::head::add_css. Re-seting params list on the right place.

Added content type and charset in HEAD block.

INcludes also previous changes from Gustaf for xinha support

  1. … 1 more file in changeset.
Non-info file merge results, with conflicts fixed

  1. … 726 more files in changeset.
Added language support for tinymce

Improved support for the ThemeCSS subsite param, provided the upgrade

script, and bumped the version number.

  1. … 5 more files in changeset.
Roll back Torben changes. If you use deprecated properties (e.g. title), use blank-compat instead of blank-master.

making doc(title) failthrough more forgiving.. lets show the best possible, even if only during a test evaluation