fix Caddyfile config, update PHP dependencies, vendor in frontend dep…

…endencies and define a Content Security Policy
BcnBitcoinOnly · Jul 27, 2024 · 5cc99ba · 5cc99ba
1 parent 4ed83ae
commit 5cc99ba
Show file tree

Hide file tree

Showing 8 changed files with 80 additions and 62 deletions.
diff --git a/composer.json b/composer.json
@@ -15,7 +15,7 @@
  "uma/dic": "^4.0"
  },
  "require-dev": {
- "friendsofphp/php-cs-fixer": "^3.59",
+ "friendsofphp/php-cs-fixer": "^3.60",
  "phpunit/phpunit": "^11.2",
  "roave/security-advisories": "dev-latest"
  },

diff --git a/composer.lock b/composer.lock
diff --git a/docs/caddy/Caddyfile-dev b/docs/caddy/Caddyfile-dev
@@ -1,5 +1,6 @@
 :80 {
  root * /var/www/signet-faucet/web
+ file_server
  encode zstd gzip
  php_fastcgi php-fpm:9000
 }
diff --git a/docs/caddy/Caddyfile-prod b/docs/caddy/Caddyfile-prod
@@ -1,5 +1,6 @@
 faucet.example.com {
  root * /var/www/signet-faucet/current/web
+ file_server
  encode zstd gzip
  php_fastcgi unix//run/php/php-fpm.sock {
  resolve_root_symlink

diff --git a/src/DI/Faucet.php b/src/DI/Faucet.php
@@ -36,6 +36,7 @@ public function provide(Container $c): void
  $twig->getEnvironment()->addGlobal('faucet_max_btc', (string) $settings->maxOneTimeBtc);
  $twig->getEnvironment()->addGlobal('use_captcha', $settings->useCaptcha);
  $twig->getEnvironment()->addGlobal('use_password', null !== $settings->passwordBcryptHash);
+ $twig->getEnvironment()->addGlobal('random_nonce', base64_encode(random_bytes(12)));
 
  return $twig;
  });

diff --git a/views/index.html.twig b/views/index.html.twig
@@ -3,9 +3,11 @@
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
+ <meta name="htmx-config" content='{"inlineStyleNonce":"{{ random_nonce }}"}'>
+ <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'nonce-{{ random_nonce }}'; object-src 'none';">
  <title>{{ faucet_name }}</title>
- <script src="https://unpkg.com/htmx.org@2.0.0" integrity="sha384-wS5l5IKJBvK6sPTKa2WZ1js3d947pvWXbPJ1OmWfEuxLgeHcEbjUUA5i9V5ZkpCw" crossorigin="anonymous"></script>
- <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.1/css/bulma.min.css" integrity="sha384-u1DpPo/VC1cCewPdLA1ujElPdm1c/ZVa5MNAV6930PlrYYXhoKH/+hui6tE7szxu" crossorigin="anonymous">
+ <script src="/js/htmx-2.0.1.min.js"></script>
+ <link rel="stylesheet" href="/css/bulma-1.0.2.min.css">
  <link rel="stylesheet" href="/css/main.css">
 </head>
 

diff --git a/web/css/bulma-1.0.2.min.css b/web/css/bulma-1.0.2.min.css
diff --git a/web/js/htmx-2.0.1.min.js b/web/js/htmx-2.0.1.min.js