Allow Users to Specify Alternate Sources for Content-Security Policy

[arno-st]

Describe the bug

Using a call to an external javascript, can't be executed due to configuration of contend-security to tigth

To Reproduce

I'm using a Mapping plugin who do a call on the following url:
https://unpkg.com/[email protected]/dist/leaflet.css
https://unpkg.com/[email protected]/dist/leaflet.js

it's openstreet map componnents, and it give the following error:

Content Security Policy: The page settings prevented a resource from loading at https://unpkg.com/[email protected]/dist/leaflet.css ("style-src").
Content Security Policy: The page settings prevented a resource from loading at https://unpkg.com/[email protected]/dist/leaflet.js ("script-src").

it's on Cacti 1.2.14 but it's like that since the dev team added contewnt-security.
And i try on Firefox and IE.

I try the Console > Configuration > Setting > General
Called: Allow Unsafe JavaScript eval() calls
Set that to Yes.

but that dosen't change anything.

And I have no clue ho to solve that and what to change to apply on the current content-security settings

[cigamit]

Not a Cacti bug, but a bug within how the plugin works I believe.

Also duplicate of Cacti/plugin_gpsmap#12

[arno-st]

Not a duplicate exactly, it's not the same plugin.

But I would love to have some input, to find the bug on this (my) plugin !!
Here is the part of the code that is not working s I expect him:

<script src="https://unpkg.com/[email protected]/dist/leaflet.js" integrity="sha512-gZwIG9x3wUXg2hdXF6+rVkLF/0Vi9U8D2Ntg4Ga5I5BZpVkVxlJWbSQtXPSiUTtC0TjtGOmxa1AJPuV0CPthew==" crossorigin=""></script>

and you can find the whole code here:
https://github.com/arno-st/map

It was working fine before the security-contend, and I know I'm way far from THE developer in PHP and web app, but willing to learn!

So any input you can give me is welcome

[TheWitness]

We've got a but like this in the main Cacti issue tracker as well. I'm going to add another setting to loosen the security restrictions. Might have it done tonight. We'll see.

[TheWitness]

Looking through the spec's again, we may have to allow one to many origin's outside of 'self'. Basically make it a configuration option.

[TheWitness]

Hopefully, this is self explanatory.

[arno-st]

Almost good
You just need to add $alternate to img-src and it's ok

[TheWitness]

Okay, test again.

[arno-st]

Yup perfect thanks for your prompt action

[squad1534]

I'm facing this same issue in Debian Buster will this fix make it into buster-backports?

[TheWitness]

You need to direct this to @paulgevers.

[paulgevers]

@squad1534 yes it will, once there is a new cacti release, I packaged it for unstable, the package migrates to testing (and somebody pings me ;) )

[TheWitness]

@paulgevers, we have been delaying the 1.2.15 for a bit now picking up a few additional bugs here and there. There are a number of users and companies testing the 1.2.x branch. I think we are pretty close right now. When @netniV thinks we are ready, we will pull the trigger.

[netniV]

I am thinking next weekend would be good. Most things seem to have calmed down again.

[bmfmancini]

That works for me!

…

On Sun, Oct 25, 2020, 09:26 Mark Brugnoli-Vinten ***@***.***> wrote: I am thinking next weekend would be good. Most things seem to have calmed down again. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#3808 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGEXTEBHW6I7NRPCGXHU33SMQRRHANCNFSM4RO5KNFA> .

[squad1534]

Sounds great, thanks Devs!