1
0
mirror of https://github.com/janeczku/calibre-web synced 2025-10-21 18:47:39 +00:00

further refactored user login

This commit is contained in:
Ozzie Isaacs
2023-02-04 14:51:41 +01:00
parent 98da7dd5b0
commit f8fbc807f1
11 changed files with 71 additions and 82 deletions

View File

@@ -24,7 +24,7 @@ import mimetypes
import chardet # dependency of requests
import copy
from flask import Blueprint, jsonify, g
from flask import Blueprint, jsonify
from flask import request, redirect, send_from_directory, make_response, flash, abort, url_for
from flask import session as flask_session
from flask_babel import gettext as _
@@ -54,6 +54,8 @@ from .usermanagement import login_required_if_no_ano
from .kobo_sync_status import remove_synced_book
from .render_template import render_title_template
from .kobo_sync_status import change_archived_books
from .services.worker import WorkerThread
from .tasks_status import render_task_status
feature_support = {
'ldap': bool(services.ldap),
@@ -79,7 +81,7 @@ except ImportError:
@app.after_request
def add_security_headers_and_shelves(resp):
def add_security_headers(resp):
csp = "default-src 'self'"
csp += ''.join([' ' + host for host in config.config_trustedhosts.strip().split(',')])
csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self'"
@@ -98,9 +100,6 @@ def add_security_headers_and_shelves(resp):
resp.headers['X-Frame-Options'] = 'SAMEORIGIN'
resp.headers['X-XSS-Protection'] = '1; mode=block'
resp.headers['Strict-Transport-Security'] = 'max-age=31536000;'
g.shelves_access = ub.session.query(ub.Shelf).filter(
or_(ub.Shelf.is_public == 1, ub.Shelf.user_id == current_user.id)).order_by(ub.Shelf.name).all()
return resp