burmatovan/openuds
1
0
Fork 0
forked from shaba/openuds
Code Issues Pull Requests Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/v3.6'

Browse Source
This commit is contained in:
Adolfo Gómez García 2022-09-05 12:53:50 +02:00
commit 7b877e3aea
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
server/src/uds/core/util/middleware/security.py
View File

@ -34,6 +34,7 @@ logger = logging.getLogger(__name__)
from django.http import HttpResponse from django.http import HttpResponse
from uds.core.util.config import GlobalConfig from uds.core.util.config import GlobalConfig
from uds.core.auths.auth import isTrustedSource
if typing.TYPE_CHECKING: if typing.TYPE_CHECKING:
from django.http import HttpRequest from django.http import HttpRequest
@ -57,8 +58,18 @@ class UDSSecurityMiddleware:
def __call__(self, request: 'HttpRequest') -> 'HttpResponse': def __call__(self, request: 'HttpRequest') -> 'HttpResponse':
# If bot, break now # If bot, break now
ua = request.META.get('HTTP_USER_AGENT', 'Connection Maybe a bot. No user agent detected.') ua = request.META.get(
if bot.search(ua): 'HTTP_USER_AGENT', 'Connection Maybe a bot. No user agent detected.'
)
# Simple ip check, to allow "trusted" ips to access UDS
ip = (
request.META.get(
'REMOTE_ADDR',
request.META.get('HTTP_X_FORWARDED_FOR', '').split(",")[-1],
)
or '0.0.0.0'
)
if not isTrustedSource(ip) and bot.search(ua):
# Return emty response if bot is detected # Return emty response if bot is detected
logger.info( logger.info(
'Denied Bot %s from %s to %s', 'Denied Bot %s from %s to %s',
@ -77,5 +88,8 @@ class UDSSecurityMiddleware:
# Legacy browser support for X-XSS-Protection # Legacy browser support for X-XSS-Protection
response.headers.setdefault('X-XSS-Protection', '1; mode=block') response.headers.setdefault('X-XSS-Protection', '1; mode=block')
# Add Content-Security-Policy, see https://www.owasp.org/index.php/Content_Security_Policy # Add Content-Security-Policy, see https://www.owasp.org/index.php/Content_Security_Policy
response.headers.setdefault('Content-Security-Policy', "default-src 'self' 'unsafe-inline' 'unsafe-eval' uds: udss:; img-src 'self' https: data:;") response.headers.setdefault(
'Content-Security-Policy',
"default-src 'self' 'unsafe-inline' 'unsafe-eval' uds: udss:; img-src 'self' https: data:;",
)
return response return response