Anonymous | Login
Project:
RSS
  
News | My View | View Issues | Roadmap | Summary

View Issue DetailsJump to Notes ] Issue History ] Print ]
ID
0047837
TypeCategorySeverityReproducibilityDate SubmittedLast Update
defect[POS2] Coreminorhave not tried2021-10-13 09:102021-11-11 07:01
ReporteralostaleView Statuspublic 
Assigned Toalostale 
PrioritynormalResolutionfixedFixed in Version
StatusclosedFix in branchFixed in SCM revision
ProjectionnoneETAnoneTarget Version
OSAnyDatabaseAnyJava version
OS VersionDatabase versionAnt version
Product VersionSCM revision 
Review Assigned To
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary

0047837: index.html has inline scripts

DescriptionCore2 applications' index.html has some inline scripts. This is a discouraged practice. Its execution would be prevented if an strict CSP is put in place [1].

---
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP [^]
Steps To Reproduce1. Configure app server to include CSP header by either:

a. setting it in Apache
or
b. setting it in Tomcat (ie. apply attached diff)

2. Run pos2 (in production mode)
  -> ERROR: it is not rendered
TagsNo tags attached.
Attached Filesdiff file icon tomcat-csp.diff [^] (1,050 bytes) 2021-10-13 09:11 [Show Content]

- Relationships Relation Graph ] Dependency Graph ]
related to defect 0046950 closedalostale Openbravo ERP prevent image inline scripts 
blocks feature request 0047996 acknowledgedTriage Platform Base POS2 make core2/pos2 CSP ready 

-  Notes
(0132365)
hgbot (developer)
2021-10-15 13:21

Merge Request created: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2/-/merge_requests/650 [^]
(0132947)
hgbot (developer)
2021-11-11 07:01

Merge request merged: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2/-/merge_requests/650 [^]
(0132948)
hgbot (developer)
2021-11-11 07:01

Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2 [^]
Changeset: d6faee6d1115154bb728de8624a2428a178827b0
Author: Asier Lostalé <asier.lostale@openbravo.com>
Date: 2021-11-11T05:59:41+00:00
URL: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2/-/commit/d6faee6d1115154bb728de8624a2428a178827b0 [^]

fixed ISSUE-47837: index.html has inline scripts

It fixes the two inline scripts that were present in index.html when
served in production mode:

1. prevents CRA to inline script in index.html

By default when CRA builds the production bundle, inlines the main
script in the index.html file.

Adding the INLINE_RUNTIME_CHUNK=false environment variable to the build
prevents this behavior importing the script from a separate file.

2. removes title setter inline script in index.html

This inline script using CRA's variable substitution to set the
application's title cannot direclty be used with the same mechanism from
js files as substitution occurs only in index.html.

Setting the title has been moved to initialization phase.

---
M src/org/openbravo/core2/build/ProductionBundleBuilder.java
M web-jspack/org.openbravo.core2/public/index.html
M web-jspack/org.openbravo.core2/src/core/AppInitializer.js
M web-jspack/org.openbravo.core2/src/core/Initialization.js
---

- Issue History
Date Modified Username Field Change
2021-10-13 09:10 alostale New Issue
2021-10-13 09:10 alostale Assigned To => Retail
2021-10-13 09:10 alostale Triggers an Emergency Pack => No
2021-10-13 09:11 alostale File Added: tomcat-csp.diff
2021-10-13 09:12 alostale Relationship added related to 0046950
2021-10-13 09:17 alostale Proposed Solution updated
2021-10-15 13:21 hgbot Note Added: 0132365
2021-10-18 11:28 guilleaer Status new => scheduled
2021-10-18 11:28 guilleaer Assigned To Retail => alostale
2021-11-05 07:33 alostale Issue cloned 0047996
2021-11-05 07:33 alostale Relationship added blocks 0047996
2021-11-05 07:39 alostale Type feature request => defect
2021-11-05 07:39 alostale Summary make core2/pos2 CSP ready => index.html has inline scripts
2021-11-05 07:39 alostale Description Updated View Revisions
2021-11-05 07:39 alostale Steps to Reproduce Updated View Revisions
2021-11-05 07:39 alostale Proposed Solution updated
2021-11-11 07:01 hgbot Note Added: 0132947
2021-11-11 07:01 hgbot Resolution open => fixed
2021-11-11 07:01 hgbot Status scheduled => closed
2021-11-11 07:01 hgbot Note Added: 0132948


Copyright © 2000 - 2009 MantisBT Group
Powered by Mantis Bugtracker