diff --git a/apimanager/apimanager/settings.py b/apimanager/apimanager/settings.py index 78501ec..16e6c06 100644 --- a/apimanager/apimanager/settings.py +++ b/apimanager/apimanager/settings.py @@ -77,6 +77,7 @@ INSTALLED_APPS = [ MIDDLEWARE = [ # 'django.middleware.cache.UpdateCacheMiddleware', + 'csp.middleware.CSPMiddleware', 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.locale.LocaleMiddleware', @@ -88,6 +89,20 @@ MIDDLEWARE = [ # 'django.middleware.cache.FetchFromCacheMiddleware', ] +# Content Security Policy - External Urls for scripts, styles, and images should be included here +#TODO these outside scripts should really just be loaded when we run "manage.py collectstatic" +# Or the whole static folder could be uploaded to github, this prevents API manager breaking when +# we run it on a server that may not connect to these sites + +# Inline styles loaded by jsoneditor.min.js have been allowed by adding their hashes to CSP_STYLE_SRC + +CSP_IMG_SRC = ("'self' data:", 'https://static.openbankproject.com') +CSP_STYLE_SRC = ("'self' 'sha256-z2a+NIknPDE7NIEqE1lfrnG39eWOhJXWsXHYGGNb5oU=' 'sha256-Dn0vMZLidJplZ4cSlBMg/F5aa7Vol9dBMHzBF4fGEtk=' 'sha256-sA0hymKbXmMTpnYi15KmDw4u6uRdLXqHyoYIaORFtjU=' 'sha256-jUuiwf3ITuJc/jfynxWHLwTZifHIlhddD8NPmmVBztk=' 'sha256-RqzjtXRBqP4i+ruV3IRuHFq6eGIACITqGbu05VSVXsI='", 'https://cdnjs.cloudflare.com', ) +CSP_SCRIPT_SRC = ("'self' 'sha256-4Hr8ttnXaUA4A6o0hGi3NUGNP2Is3Ep0W+rvm+W7BAk=' 'sha256-GgQWQ4Ejk4g9XpAZJ4YxIgZDgp7CdQCmqjMOMh9hD2g=' 'sha256-05NIAwVBHkAzKcXTfkYqTnBPtkpX+AmQvM/raql3qo0='", 'http://code.jquery.com', 'https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/', 'https://cdnjs.cloudflare.com') +CSP_FONT_SRC = ("'self'", 'http://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/') +CSP_FRAME_ANCESTORS = ("'self'") +CSP_FORM_ACTION = ("'self'") + #cache the view page, we set 60s = 1m, # CACHE_MIDDLEWARE_SECONDS = 60 @@ -123,7 +138,8 @@ TEMPLATES = [ 'base.context_processors.api_tester_url', 'base.context_processors.portal_page', 'base.context_processors.logo_url', - 'base.context_processors.override_css_url' + 'base.context_processors.override_css_url', + 'csp.context_processors.nonce' ], }, }, diff --git a/apimanager/base/static/css/base.css b/apimanager/base/static/css/base.css index 1a65793..661a91b 100644 --- a/apimanager/base/static/css/base.css +++ b/apimanager/base/static/css/base.css @@ -31,6 +31,9 @@ footer a:hover, .footer a:focus { color: #fff; } +.footer-content-wrapper { + cursor:pointer; +} .navbar-brand img { height: 20px; @@ -74,6 +77,20 @@ footer a:hover, .footer a:focus { margin-top: -6px; } +.navbar-inner { + margin-left:15% !important; +} + +.navbar-nav { + margin-left:8rem; +} + +.obp-home-button { + position:absolute; + margin-left: -70px !important; + top:-5px; +} + /*.dropdown-menu > .active > a, .dropdown-menu > .active > a:hover, .dropdown-menu > .active > a:active {*/ /*background-color: #53c4ef;*/ /*}*/ @@ -211,6 +228,12 @@ table.tablesorter thead tr .headerSortDown, table.tablesorter thead tr .headerSo margin-left:5rem; text-decoration: none !important; } + +.language-select > a { + color:#fff; + text-decoration: none !important; +} + #uk { cursor:pointer; } diff --git a/apimanager/base/templates/base.html b/apimanager/base/templates/base.html index 5cef714..e492948 100644 --- a/apimanager/base/templates/base.html +++ b/apimanager/base/templates/base.html @@ -19,7 +19,7 @@