kenmirrors/firefly-iii
1
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2025-10-12 23:45:10 +00:00
Code Issues Projects Releases Wiki Activity

Update analytics code.

Browse Source
This commit is contained in:
James Cole
2020-01-17 04:30:44 +01:00
parent 3852dbeacc
commit ff44dbaea0
9 changed files with 73 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
app/Http/Middleware/SecureHeaders.php
View File

@@ -47,18 +47,17 @@ class SecureHeaders
$nonce = base64_encode(random_bytes(16));
app('view')->share('JS_NONCE', $nonce);
$response = $next($request);
$googleScriptSrc = $this->getGoogleScriptSource();
$googleImgSrc = $this->getGoogleImgSource();
$csp = [
$response = $next($request);
$trackingScriptSrc = $this->getTrackingScriptSource();
$csp = [
"default-src 'none'",
"object-src 'self'",
sprintf("script-src 'unsafe-inline' 'nonce-%1s' %2s", $nonce, $googleScriptSrc),
sprintf("script-src 'unsafe-inline' 'nonce-%1s' %2s", $nonce, $trackingScriptSrc),
"style-src 'self' 'unsafe-inline'",
"base-uri 'self'",
"font-src 'self' data:",
"connect-src 'self'",
sprintf("img-src 'self' data: https://api.tiles.mapbox.com %s", $googleImgSrc),
sprintf("img-src 'self' data: https://api.tiles.mapbox.com %s", $trackingScriptSrc),
"manifest-src 'self'",
];
@@ -99,27 +98,15 @@ class SecureHeaders
return $response;
}
/**
* @return string
*/
private function getGoogleImgSource(): string
{
if ('' !== config('firefly.analytics_id')) {
return 'www.google-analytics.com';
}
return '';
}
/**
* Return part of a CSP header allowing scripts from Google.
*
* @return string
*/
private function getGoogleScriptSource(): string
private function getTrackingScriptSource(): string
{
if ('' !== config('firefly.analytics_id')) {
return 'www.googletagmanager.com www.google-analytics.com';
if ('' !== (string)config('firefly.tracker_site_id') && '' !== (string)config('firefly.tracker_url')) {
return (string)config('firefly.tracker_url');
}
return '';