29 Commits (673d8528c361b4c1886c3f77ec268ed9e58efc2f)

Author	SHA1	Message	Date
Oliver Günther	0fa8b4a77b	Forward CSP extensions to login controller (#9047) ... * Forward CSP extensions to login controller * Extend spec for double auth code * stabilize spec On my machine, since I have an s3 bucket configured, the spec failed Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Markus Kahl	939f1d1df7	s3 hosts differ for pre-signed form uploads and downloads ... the latter include the region in the URL. This can possibly be changed so that we only need one host. Perhaps the region is optional in the carrierwave-generated remote download URLs.	4 years ago
Markus Kahl	c1b82bad00	direct uploads to S3 for attachments including IFC models ... Co-authored-by: Oliver Günther <mail@oliverguenther.de>	4 years ago
Oliver Günther	739860cc48	Fix spec not testing for response headers in selenium	5 years ago
Wieland Lindenthal	1841304742	Add Oauth redirect hosts to CSP action-form	5 years ago
Oliver Günther	6f6bec8b22	Add optional sentry handling of frontend errors	5 years ago
Cyril Rohr	27564608db	Display a security badge with the installation status ... vulnerable, unknown, up to date, update available	6 years ago
Oliver Günther	8d265e4f84	Allow to load rack-mini-profiler with OPENPROJECT_RACK_PROFILER_ENABLED	6 years ago
Oliver Günther	18b9a7c340	Allow proxy IP to differ from localhost ... [ci skip]	6 years ago
Jens Ulferts	97ad5e0008	reenable previews	6 years ago
Oliver Günther	3fef1f697d	Add spec for code-block macro	6 years ago
Oliver Günther	e3903a70e6	Disable unsafe-eval now that we're on AOT	6 years ago
Oliver Günther	68e184f41f	Add resize helper for resizing images	6 years ago
Jens Ulferts	7da9bde5c8	fix angular cli handling in test ... Proxy href can be configured via OPENPROJECT_CLI_PROXY='[PROXY HREF]'. 'http://localhost:4200' is configured to be the default. Also fixes accessing the server via port 3000 in dev mode.	7 years ago
Oliver Günther	e1e6b7a959	Extract frontend asset helper building ... In DEV and TEST mode, it should be possible to use the running CLI to get up-to-date assets without recompiling.	7 years ago
Oliver Günther	02d44331af	Add ws/http connect_src to dev mode only	7 years ago
Roman Roelofsen	ec3728ac14	working dev mode	7 years ago
Oliver Günther	5da004491c	Remove https from default-src ... [ci skip]	7 years ago
Wieland Lindenthal	e5fca5fa65	Limit where crowdin can communicate to. ... Works in Chrome but not in FF.	7 years ago
Oliver Günther	dd5d9e1a19	Move crowdin CSP into separate helper to override CSP at runtime ... This avoids having cdn.crowdin.com allowed in the script-src even if the user doesnt use in-context translations.	7 years ago
Wieland Lindenthal	a6f88f552f	Add vimeo as allowed frame-src for introductional video (#6227) ... [ci skip]	7 years ago
Oliver Günther	e2d7c7b070	Allow crowdin in-context with CSP, but add opt-out ... Since the crowdin iframe adds all sorts of assets, we will want to disabled that.	7 years ago
Oliver Günther	33eeb8c0df	Allow sameorigin iframe for help modal ... We may want to remove that	7 years ago
Oliver Günther	8c477e5860	Fix more project settings related specs	7 years ago
Oliver Günther	07f92b911a	Allow unsafe-eval for Angular JIT	7 years ago
Oliver Günther	06472450c6	Implement CSP with secure_headers gem	7 years ago