From 250e33b57160f36d73dcd5fe82f852d56dadcc64 Mon Sep 17 00:00:00 2001 From: Pontoporeia Date: Fri, 10 Jul 2026 15:07:07 +0200 Subject: [PATCH] fix: add frame-src CSP for videos.erg.be and depnum.happyngreen.fr --- TODO.md | 55 +---------------------------------------------- nginx/xamxam.conf | 6 +++--- 2 files changed, 4 insertions(+), 57 deletions(-) diff --git a/TODO.md b/TODO.md index d68fca4..8120b73 100644 --- a/TODO.md +++ b/TODO.md @@ -1,56 +1,3 @@ # TODO -- [x] Simplify `tfe.php` HTML structure (remove `.tfe-layout` wrapper, remove `.tfe-synopsis-column` wrapper) -- [x] Simplify `tfe.css` — replace flex-column with grid where possible, merge `.tfe-layout` into `.tfe-content-row`, remove dead wrappers -- [x] Commit changes -- [x] Remove "Mo" option from duration — keep only minutes and pages -- [x] Combine pages and minutes as separate fields (both can be set simultaneously) -- [x] Fix minutes input visibility (can't see what's typed) -- [x] Add `has_annexes` checkbox to form + DB column -- [x] Display duration on admin backoffice recap page -- [x] Update public TFE page duration display for new combined format -- [x] Fix `handleAutosaveResponse is not defined` — load `autosave-handler.js` on about_page edit view -- [x] Fix `handleAutosaveResponse is not defined` in admin add/edit — function was scoped inside IIFE bundle, not on window -- [x] Fix search result cards: title and author always below image/gradient, remove text overlay on placeholder gradient -- [x] Change search results to 10 per page with HTMX pagination (no-JS fallback preserved) -- [x] Bump to 15 results/page, make results area vertically scrollable, sticky pagination at viewport bottom -- [x] Fix HTMX targetError: move #search-results wrapper inside fragment so it survives outerHTML swaps -- [x] Add range counter to results header (e.g. "1–15 sur 112 résultats") -- [x] Collapsible filter controls with
/ + active filter badge on mobile -- [x] Responsive paginator: hide first/last buttons on mobile, smaller touch targets -- [x] Compact range counter on mobile: "1–15 / 112" instead of full "1–15 sur 112 résultats" -- [x] Remove orientation display from search result card meta -- [x] Add bulk select/delete to tmp cleanup dialog (like admin/index.php pattern) -- [x] Move cleanup UI from modal to dedicated page (like add.php/edit.php) -- [x] Replace
with
/ in cleanup fragments (like contenus.php) -- [x] Standardise test group recipes: lint-php, lint-css, lint-js, test + add fix recipe + make lint pass clean -- [x] Remove Mot de passe column from acces.php, add key.svg icon button in Actions to copy password to clipboard, reorder actions (URL/password/edit/toggle/archive), switch URL icon to link-simple.svg -- [x] Fix CC2r: removed hidden seeds (were stale/overriding user input), render initial licence-choice from \$formData; Interne want_license unchecked clears CC2r+licence, switching from other modes preserves values; CC2r independent toggle; licence dropdown has no-licence placeholder -- [x] Dans le formulaire admin, le contact privé ne se sauvegarde pas. -- [x] Remove "Rendre le contact visible publiquement sur la fiche du TFE" from admin add/edit forms -- [x] Auto-show contact on public TFE page when contact_visible is filled (no checkbox needed) -- [x] Fix file size limits: align all layers (JS/FilepondHandler/ThesisFileHandler/validate-fragment) — video/audio 5 GB, default 500 MB, PDF 100 MB; fix JS fileValidateSizeFilter gate bug that rejected AV files >1 GB despite 8 GB per-ext cap -- [x] Fix: deleting contact groups in apropos form not persisted (no change event after DOM removal, autosave never triggered) -- [x] Improve h1, h2, h3 size difference in base.css heading scale -- [x] Rework TFE page desktop layout: two columns 35vw/1fr, left = author/title/meta/synopsis, right = files, media 100% width; columns scroll independently, content fits 100vw; no bottom padding on main; add &scrollbar=0 to PDF iframe URLs -- [x] 'Promoteur·ice ULB' remplacé par 'Promoteur·ice université' (changement juste l'étiquette) -- [x] PDF viewer: fix page navigation buttons (prev/next) — build toolbar after canvases exist & query canvases fresh in scroll handler -- [x] PDF viewer: render pages smaller by default (0.85× scale) -- [x] PDF viewer: add dark transparent violet background behind pages when expanded -- [x] pdf-viewer: expand to fill right column (not whole page), center pages, freeze column on expand -- [x] pdf-viewer: fix toolbar width (align-self:stretch), hide sibling file items when expanded -- [x] Fix createThesis SQL: extra `?` placeholder in VALUES (27 values for 26 columns) + add integration tests -- [x] CSV import/export: single source of truth (CSV_COLUMNS), add missing columns (duration, annexes, license_custom, contact_visible, objet, cc2r, exemplaires), fix XamxamInitFilePonds → window.n, generate import hint from headers -- [x] Extend admin auth cookie lifetime from session-only to 1 week (604800s) -- [x] Close TOC (licence/charte/apropos) and Filtres (search.php)
by default on mobile -- [x] Wider heading scale (h1/h2/h3) for apropos/licence/charte pages: step-5 / step-3 / step-1 -- [x] Reduce heading sizes in content-page.css, use explicit clamp() values instead of step-system vars, tighter hierarchy -- [x] Fix TOC: extractToc now captures h1/h2/h3 (was h1-only), templates render level classes, toc.css adds indentation per level -- [x] Masquer le bloc "Durée" sur la page TFE quand aucune durée n'est encodée (ni pages ni minutes) -- [x] Fix: locked_year cleared on edit — edit dialog didn't populate the field, so any edit cleared the locked academic year -- [x] Fix repertoire Années column: sort reverse chronological (newest first) instead of ascending alpha -- [x] TFE website embed: wrap iframe + button in overlay-style div with "Site web" pill badge on left corner, clearer link text -- [x] Redirect internal metadata links on TFE page from /repertoire to /search (orientation, AP, finalité, year, keywords); add query= for search bar prefill; fix filter
visibility on desktop; add keyword to filterKeys badge; add hidden keyword input + visible chip to filter form so keyword filter survives form submission -- [x] Fix Logger default level: production default was WARNING, but all facades (AppLogger, AdminLogger, Audit) write at INFO — causing submission/admin/audit logs to be silently discarded -- [x] Add structured logging to PeerTube upload/delete: replace raw error_log() with Logger::get('app')->info() for successes and ErrorHandler::log() for failures in PeerTubeService, FilepondHandler, ThesisCreateController, ThesisFileHandler -- [x] Fix word-break before punctuation in TFE titles/meta: override aggressive `word-break: break-word` from base.css with `word-break: normal` + `hyphens: auto` on .tfe-title, .tfe-author, .tfe-meta-item; replace spaces before colons in meta labels with ` ` (French typographic rule) +- [x] Fix CSP: add `frame-src` to allow iframes from `videos.erg.be` and `depnum.happyngreen.fr` diff --git a/nginx/xamxam.conf b/nginx/xamxam.conf index 0d9f144..f9d2184 100644 --- a/nginx/xamxam.conf +++ b/nginx/xamxam.conf @@ -56,7 +56,7 @@ server { # Security headers add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload;" always; - add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; + add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; add_header X-Frame-Options "DENY" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; @@ -145,7 +145,7 @@ server { # script-src needs 'unsafe-inline' for the OverType editor init block # and the live-reload poller (dev only). Admin is already auth-gated. # 'unsafe-eval' is required by htmx (uses Function() internally). - add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; + add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; # Disable directory listing autoindex off; @@ -190,7 +190,7 @@ server { # try_files triggers an internal redirect to location = /index.php, which # loses this CSP override and inherits the server-block frame-ancestors 'none'. location = /media { - add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always; + add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always; # Direct fastcgi_pass to /index.php (no try_files) so add_header survives. # We can't use snippets/fastcgi-php.conf because its try_files # $fastcgi_script_name =404 would fail — $fastcgi_script_name is /media