mirrors/calibre-web
1
0
Fork 0
mirror of https://github.com/janeczku/calibre-web synced 2024-12-25 17:40:31 +00:00
Code Issues Releases Wiki Activity

Bugfix csp header

Browse Source 
Bugfix for loading metadata from google with old books (publishing date only year)
This commit is contained in:
Ozzie Isaacs 2023-01-21 17:01:34 +01:00
parent 1cd05d614c
commit a2bf6dfb7b
3 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cps/__init__.py
View File

@ -140,7 +140,7 @@ def create_app():
web_server.stop(True) web_server.stop(True)
sys.exit(7) sys.exit(7)
for res in dependency_check() + dependency_check(True): for res in dependency_check() + dependency_check(True):
log.info('*** "{}" version does not fit the requirements. ' log.info('*** "{}" version does not meet the requirements. '
'Should: {}, Found: {}, please consider installing required version ***' 'Should: {}, Found: {}, please consider installing required version ***'
.format(res['name'], .format(res['name'],
res['target'], res['target'],

7
cps/metadata_provider/google.py
View File

@ -19,6 +19,7 @@
# Google Books api document: https://developers.google.com/books/docs/v1/using # Google Books api document: https://developers.google.com/books/docs/v1/using
from typing import Dict, List, Optional from typing import Dict, List, Optional
from urllib.parse import quote from urllib.parse import quote
from datetime import datetime
import requests import requests
@ -81,7 +82,11 @@ class Google(Metadata):
match.description = result["volumeInfo"].get("description", "") match.description = result["volumeInfo"].get("description", "")
match.languages = self._parse_languages(result=result, locale=locale) match.languages = self._parse_languages(result=result, locale=locale)
match.publisher = result["volumeInfo"].get("publisher", "") match.publisher = result["volumeInfo"].get("publisher", "")
match.publishedDate = result["volumeInfo"].get("publishedDate", "") try:
datetime.strptime(result["volumeInfo"].get("publishedDate", ""), "%Y-%m-%d")
match.publishedDate = result["volumeInfo"].get("publishedDate", "")
except ValueError:
match.publishedDate = ""
match.rating = result["volumeInfo"].get("averageRating", 0) match.rating = result["volumeInfo"].get("averageRating", 0)
match.series, match.series_index = "", 1 match.series, match.series_index = "", 1
match.tags = result["volumeInfo"].get("categories", []) match.tags = result["volumeInfo"].get("categories", [])

12
cps/web.py
View File

@ -85,13 +85,15 @@ def add_security_headers(resp):
csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self'" csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self'"
if request.path.startswith("/author/") and config.config_use_goodreads: if request.path.startswith("/author/") and config.config_use_goodreads:
csp += " images.gr-assets.com i.gr-assets.com s.gr-assets.com" csp += " images.gr-assets.com i.gr-assets.com s.gr-assets.com"
csp += " blob: data:;" csp += " data:"
csp += " object-src 'none';"
resp.headers['Content-Security-Policy'] = csp
if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive: if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive:
resp.headers['Content-Security-Policy'] += " *" csp += " *;"
elif request.endpoint == "web.read_book": elif request.endpoint == "web.read_book":
resp.headers['Content-Security-Policy'] += " style-src-elem 'self' blob: 'unsafe-inline';" csp += " style-src-elem 'self' blob: 'unsafe-inline';"
else:
csp += ";"
csp += "object-src: 'none';"
resp.headers['Content-Security-Policy'] = csp
resp.headers['X-Content-Type-Options'] = 'nosniff' resp.headers['X-Content-Type-Options'] = 'nosniff'
resp.headers['X-Frame-Options'] = 'SAMEORIGIN' resp.headers['X-Frame-Options'] = 'SAMEORIGIN'
resp.headers['X-XSS-Protection'] = '1; mode=block' resp.headers['X-XSS-Protection'] = '1; mode=block'