Add Content-Security-Policy header - related to #80

CHANGELOG

@@ -7,6 +7,7 @@ Revision history for Lufi
 	- Use GzipStatic and StaticCache plugins for speed
 	- Allow to block files by setting an abuse field in DB
 	- Display file size when uploading
+	- Add Content-Security-Policy header
 
 0.02.2 2017-09-18
 	- Fix cron tasks bug

cpanfile

@@ -5,6 +5,7 @@ requires 'Mojolicious::Plugin::I18N';
 requires 'Mojolicious::Plugin::Mail';
 requires 'Mojolicious::Plugin::GzipStatic';
 requires 'Mojolicious::Plugin::StaticCache';
+requires 'Mojolicious::Plugin::CSPHeader';
 requires 'Mojolicious::Plugin::FiatTux::Helpers', '== 0.01', url => 'https://framagit.org/luc/mojolicious-plugin-fiattux-helpers/-/archive/0.01/mojolicious-plugin-fiattux-helpers-0.01.tar.gz';
 requires 'Mojolicious::Plugin::FiatTux::GrantAccess', '== 0.05', url => 'https://framagit.org/luc/mojolicious-plugin-fiattux-grantaccess/-/archive/0.05/mojolicious-plugin-fiattux-grantaccess-0.05.tar.gz';
 requires 'EV';

cpanfile.snapshot

@@ -1025,6 +1025,13 @@ DISTRIBUTIONS
       perl 5.010
       strict 0
       warnings 0
+  Mojolicious-Plugin-CSPHeader-0.03
+    pathname: L/LD/LDIDRY/Mojolicious-Plugin-CSPHeader-0.03.tar.gz
+    provides:
+      Mojolicious::Plugin::CSPHeader 0.03
+    requirements:
+      ExtUtils::MakeMaker 0
+      Mojolicious 7.75
   Mojolicious-Plugin-DebugDumperHelper-0.03
     pathname: L/LD/LDIDRY/Mojolicious-Plugin-DebugDumperHelper-0.03.tar.gz
     provides:

lib/Lufi.pm

@@ -32,6 +32,9 @@ sub startup {
             dbtype                   => 'sqlite',
             db_path                  => 'lufi.db',
             force_burn_after_reading => 0,
+            x_frame_options          => 'DENY',
+            x_content_type_options   => 'nosniff',
+            x_xss_protection         => '1; mode=block',
         }
     });
 
@@ -69,8 +72,8 @@ sub startup {
     # Compress static assets
     $self->plugin('GzipStatic');
 
-    # Cache static assets
+    # Headers
-    $self->plugin('StaticCache');
+    $self->plugin('Lufi::Plugin::Headers');
 
     # Fiat Tux helpers
     $self->plugin('FiatTux::Helpers');

lib/Lufi/Plugin/Headers.pm

@@ -0,0 +1,52 @@
+package Lufi::Plugin::Headers;
+use Mojo::Base 'Mojolicious::Plugin';
+
+sub register {
+    my ($self, $app) = @_;
+
+    # Assets Cache headers
+    $app->plugin('StaticCache');
+
+    # Add CSP Header
+    if (!defined($app->config('csp')) || (defined($app->config('csp')) && $app->config('csp') ne '')) {
+        my $directives = {
+            'default-src'     => "'none'",
+            'script-src'      => "'self' 'unsafe-inline' 'unsafe-eval'",
+            'style-src'       => "'self' 'unsafe-inline'",
+            'img-src'         => "'self' blob:",
+            'media-src'       => "blob:",
+            'font-src'        => "'self'",
+            'form-action'     => "'self'",
+            'base-uri'        => "'self'",
+            'connect-src'     => "'self'",
+        };
+
+        my $frame_ancestors = '';
+        $frame_ancestors = "'none'" if $app->config('x_frame_options') eq 'DENY';
+        $frame_ancestors = "'self'" if $app->config('x_frame_options') eq 'SAMEORIGIN';
+        if ($app->config('x_frame_options') =~ m#^ALLOW-FROM#) {
+            $frame_ancestors = $app->config('x_frame_options');
+            $frame_ancestors =~ s#ALLOW-FROM +##;
+        }
+        $directives->{'frame-ancestors'} = $frame_ancestors if $frame_ancestors;
+
+        $app->plugin('CSPHeader',
+            csp        => $app->config('csp'),
+            directives => $directives
+        );
+    }
+
+    # Add other headers
+    $app->hook(
+        before_dispatch => sub {
+            my $c = shift;
+
+            $c->res->headers->header('X-Frame-Options'        => $app->config('x_frame_options'))        if $app->config('x_frame_options');
+            $c->res->headers->header('X-Content-Type-Options' => $app->config('x_content_type_options')) if $app->config('x_content_type_options');
+            $c->res->headers->header('X-XSS-Protection'       => $app->config('x_xss_protection'))       if $app->config('x_xss_protection');
+        }
+    );
+
+}
+
+1;

lib/Mounter.pm

@@ -42,6 +42,9 @@ sub startup {
                 dbtype                   => 'sqlite',
                 db_path                  => 'lufi.db',
                 force_burn_after_reading => 0,
+                x_frame_options          => 'DENY',
+                x_content_type_options   => 'nosniff',
+                x_xss_protection         => '1; mode=block',
             }
         }
     );
@@ -49,8 +52,8 @@ sub startup {
     # Compress static assets
     $self->plugin('GzipStatic');
 
-    # Cache static assets
+    # Headers
-    $self->plugin('StaticCache');
+    $self->plugin('Lufi::Plugin::Headers');
 
     # Helpers
     $self->plugin('Lufi::Plugin::Helpers');

lufi.conf.template

@@ -184,6 +184,35 @@
     #   1 => 'Illegal content',
     #},
 
+    # Content-Security-Policy header that will be sent by Lufi
+    # Set to '' to disable CSP header
+    # https://content-security-policy.com/ provides a good documentation about CSP.
+    # https://report-uri.com/home/generate provides a tool to generate a CSP header.
+    # optional, default is "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' blob:; media-src blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
+    # the default value is good for `default` and `milligram` themes
+    #csp => "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' blob:; media-src blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
+
+    # X-Frame-Options header that will be sent by Lufi
+    # Valid values are: 'DENY', 'SAMEORIGIN', 'ALLOW-FROM https://example.com/'
+    # Set to '' to disable X-Frame-Options header
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+    # Please note that this will add a "frame-ancestors" directive to the CSP header (see above) accordingly
+    # to the chosen setting (See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors)
+    # optional, default is 'DENY'
+    #x_frame_options => 'DENY',
+
+    # X-Content-Type-Options that will be sent by Lufi
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+    # Set to '' to disable X-Content-Type-Options header
+    # optional, default is 'nosniff'
+    #x_content_type_options => 'nosniff',
+
+    # X-XSS-Protection that will be sent by Lufi
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+    # Set to '' to disable X-XSS-Protection header
+    # optional, default is '1; mode=block'
+    #x_xss_protection => '1; mode=block',
+
     #########################
     # Lufi cron jobs settings
     #########################

themes/default/lib/Lufi/I18N/ca.po

@@ -32,7 +32,7 @@ msgstr "1 any"
 msgid "24 hours"
 msgstr "24 hores"
 
-#: themes/default/templates/partial/mail.js.ep:35
+#: themes/default/templates/partial/mail.js.ep:40
 msgid ":"
 msgstr ":"
 
@@ -205,7 +205,7 @@ msgstr "Obté el fitxer"
 msgid "Get the source code on <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">the official repository</a> or on its <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 msgstr "Obteniu el codi font al <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">repositori oficial</a> o a la seva <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">rèplica a Github</a>"
 
-#: themes/default/templates/partial/mail.js.ep:30
+#: themes/default/templates/partial/mail.js.ep:35
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Hola,\\n\\nVe't aquí uns fitxers que vull compartir amb tu:"
 
@@ -341,7 +341,7 @@ msgid "Sending part XX1 of XX2. Please, be patient, the progress bar can take a
 msgstr "S'està enviant el tros XX1 de XX2. Si us plau, paciència; la barra de progrés pot trigar una mica a bellugar-se. "
 
 #. (url_for('/')
-#: themes/default/templates/partial/mail.js.ep:43
+#: themes/default/templates/partial/mail.js.ep:48
 msgid "Share your files in total privacy on %1"
 msgstr "Compartiu fitxers amb total privacitat a %1"
 
@@ -502,7 +502,7 @@ msgstr "entre %1 i %2, el fitxer es mantindrà %3 dia/es al servidor."
 msgid "between %1 and %2, the file will be kept forever."
 msgstr "entre %1 i %2, el fitxer es mantindrà per sempre al servidor."
 
-#: themes/default/templates/partial/mail.js.ep:37
+#: themes/default/templates/partial/mail.js.ep:42
 msgid "deadline: "
 msgstr "termini:"
 

themes/default/lib/Lufi/I18N/en.po

@@ -29,7 +29,7 @@ msgstr ""
 msgid "24 hours"
 msgstr ""
 
-#: themes/default/templates/partial/mail.js.ep:35
+#: themes/default/templates/partial/mail.js.ep:40
 msgid ":"
 msgstr ""
 
@@ -202,7 +202,7 @@ msgstr ""
 msgid "Get the source code on <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">the official repository</a> or on its <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 msgstr ""
 
-#: themes/default/templates/partial/mail.js.ep:30
+#: themes/default/templates/partial/mail.js.ep:35
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr ""
 
@@ -337,7 +337,7 @@ msgid "Sending part XX1 of XX2. Please, be patient, the progress bar can take a
 msgstr ""
 
 #. (url_for('/')
-#: themes/default/templates/partial/mail.js.ep:43
+#: themes/default/templates/partial/mail.js.ep:48
 msgid "Share your files in total privacy on %1"
 msgstr ""
 
@@ -496,7 +496,7 @@ msgstr ""
 msgid "between %1 and %2, the file will be kept forever."
 msgstr ""
 
-#: themes/default/templates/partial/mail.js.ep:37
+#: themes/default/templates/partial/mail.js.ep:42
 msgid "deadline: "
 msgstr ""
 

themes/default/lib/Lufi/I18N/fr.po

@@ -31,7 +31,7 @@ msgstr "1 an"
 msgid "24 hours"
 msgstr "24 heures"
 
-#: themes/default/templates/partial/mail.js.ep:35
+#: themes/default/templates/partial/mail.js.ep:40
 msgid ":"
 msgstr " :"
 
@@ -204,7 +204,7 @@ msgstr "Récupérer le fichier"
 msgid "Get the source code on <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">the official repository</a> or on its <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 msgstr "Récupérez le code source sur <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">le dépôt officiel</a> ou sur son <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">miroir Github</a>."
 
-#: themes/default/templates/partial/mail.js.ep:30
+#: themes/default/templates/partial/mail.js.ep:35
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Bonjour,\\n\\nVoici quelques fichiers que je souhaite partager avec toi :\\n"
 
@@ -339,7 +339,7 @@ msgid "Sending part XX1 of XX2. Please, be patient, the progress bar can take a
 msgstr "Envoi du fragment XX1 sur XX2. Veuillez patienter, la barre de progression peut mettre du temps avant d’avancer."
 
 #. (url_for('/')
-#: themes/default/templates/partial/mail.js.ep:43
+#: themes/default/templates/partial/mail.js.ep:48
 msgid "Share your files in total privacy on %1"
 msgstr "Partagez vos fichiers en toute confidentialité sur %1"
 
@@ -502,7 +502,7 @@ msgstr "entre %1 et %2, le fichier sera conservé %3 jour(s) ;"
 msgid "between %1 and %2, the file will be kept forever."
 msgstr "entre %1 et %2, le fichier sera conservé indéfiniment ;"
 
-#: themes/default/templates/partial/mail.js.ep:37
+#: themes/default/templates/partial/mail.js.ep:42
 msgid "deadline: "
 msgstr "dernier délai pour télécharger : "
 

themes/default/lib/Lufi/I18N/it.po

@@ -31,7 +31,7 @@ msgstr "1 anno"
 msgid "24 hours"
 msgstr "24 ore"
 
-#: themes/default/templates/partial/mail.js.ep:35
+#: themes/default/templates/partial/mail.js.ep:40
 msgid ":"
 msgstr "A :"
 
@@ -204,7 +204,7 @@ msgstr "Ottenere il file"
 msgid "Get the source code on <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">the official repository</a> or on its <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 msgstr "Ottenere il codice sorgente su <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">le dépôt officiel</a> ou sur son <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">miroir Github</a>."
 
-#: themes/default/templates/partial/mail.js.ep:30
+#: themes/default/templates/partial/mail.js.ep:35
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Buongiorno,\\n\\necco qualche file che vorrei condividere con te:\\n"
 
@@ -343,7 +343,7 @@ msgid "Sending part XX1 of XX2. Please, be patient, the progress bar can take a
 msgstr "Invio della parte XX1 su XX2. Prego attendere, la barra di avanzamento può impiegare del tempo prima di colorarsi."
 
 #. (url_for('/')
-#: themes/default/templates/partial/mail.js.ep:43
+#: themes/default/templates/partial/mail.js.ep:48
 msgid "Share your files in total privacy on %1"
 msgstr "Condividi tutti i file in totale riservatezza su %1"
 
@@ -506,7 +506,7 @@ msgstr "tra %1 e %2, il file sarà conservato %3 giorno(i);"
 msgid "between %1 and %2, the file will be kept forever."
 msgstr "tra %1 e %2, il file sarà conservato per sempre;"
 
-#: themes/default/templates/partial/mail.js.ep:37
+#: themes/default/templates/partial/mail.js.ep:42
 msgid "deadline: "
 msgstr "scadenza: "
 

themes/default/lib/Lufi/I18N/nl.po

@@ -18,7 +18,7 @@ msgstr "1 jaar"
 msgid "24 hours"
 msgstr "24 uur"
 
-#: themes/default/templates/partial/mail.js.ep:35
+#: themes/default/templates/partial/mail.js.ep:40
 msgid ":"
 msgstr ":"
 
@@ -191,7 +191,7 @@ msgstr "Download bestand"
 msgid "Get the source code on <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">the official repository</a> or on its <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 msgstr "Krijg de broncode op <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">de officiële repository</a> of op <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 
-#: themes/default/templates/partial/mail.js.ep:30
+#: themes/default/templates/partial/mail.js.ep:35
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Hallo,\\n\\nHier zijn enkele bestanden die ik met je wil delen:\\n\\n"
 
@@ -330,7 +330,7 @@ msgid "Sending part XX1 of XX2. Please, be patient, the progress bar can take a
 msgstr "Versturen deel XX1 van XX2. Een ogenblik geduld..."
 
 #. (url_for('/')
-#: themes/default/templates/partial/mail.js.ep:43
+#: themes/default/templates/partial/mail.js.ep:48
 msgid "Share your files in total privacy on %1"
 msgstr "Deel je bestanden met volledige privacy op %1"
 
@@ -521,7 +521,7 @@ msgstr "tussen %1 en %1, bestand zal bewaard worden voor %3 dag(en)."
 msgid "between %1 and %2, the file will be kept forever."
 msgstr "tussen %1 en %2, bestand zal voor altijd bewaard worden."
 
-#: themes/default/templates/partial/mail.js.ep:37
+#: themes/default/templates/partial/mail.js.ep:42
 msgid "deadline: "
 msgstr "deadline: "
 

themes/default/lib/Lufi/I18N/oc.po

@@ -31,7 +31,7 @@ msgstr "1 an"
 msgid "24 hours"
 msgstr "24 oras"
 
-#: themes/default/templates/partial/mail.js.ep:35
+#: themes/default/templates/partial/mail.js.ep:40
 msgid ":"
 msgstr " :"
 
@@ -204,7 +204,7 @@ msgstr "Recuperar lo fichièr"
 msgid "Get the source code on <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">the official repository</a> or on its <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 msgstr "Recuperatz lo còdi font sul <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">depaus oficial</a> o sus son <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">miralh Github</a>."
 
-#: themes/default/templates/partial/mail.js.ep:30
+#: themes/default/templates/partial/mail.js.ep:35
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Bonjorn,\\n\\nVaquí qualques fichièrs que desiri partejar amb tu :\\n"
 
@@ -343,7 +343,7 @@ msgid "Sending part XX1 of XX2. Please, be patient, the progress bar can take a
 msgstr "Mandadís del fragment XX1 sus XX2. Pacientatz, la barra de progression pòt metre de temps abans d’avançar."
 
 #. (url_for('/')
-#: themes/default/templates/partial/mail.js.ep:43
+#: themes/default/templates/partial/mail.js.ep:48
 msgid "Share your files in total privacy on %1"
 msgstr "Partejatz vòstres fichièrs en tota confidencialitat sus %1"
 
@@ -506,7 +506,7 @@ msgstr "entre %1 e %2, lo fichièr serà gardat %3 jorn(s) ;"
 msgid "between %1 and %2, the file will be kept forever."
 msgstr "entre %1 e %2, lo fichièr serà gardat per totjorn. ;"
 
-#: themes/default/templates/partial/mail.js.ep:37
+#: themes/default/templates/partial/mail.js.ep:42
 msgid "deadline: "
 msgstr "darrièr relambi per telecargar :"
 

themes/default/lib/Lufi/I18N/pt.po

@@ -32,7 +32,7 @@ msgstr "1 ano"
 msgid "24 hours"
 msgstr "24 horas"
 
-#: themes/default/templates/partial/mail.js.ep:35
+#: themes/default/templates/partial/mail.js.ep:40
 msgid ":"
 msgstr " :"
 
@@ -209,7 +209,7 @@ msgstr "Recuperar o ficheiro"
 msgid "Get the source code on <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">the official repository</a> or on its <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">Github mirror</a>"
 msgstr "Recupere o código-fonte no <a href=\"https://framagit.org/luc/lufi\" class=\"classic\">o depósito oficial</a> ou então <a href=\"https://github.com/ldidry/lufi\" class=\"classic\">réplicas Github</a>."
 
-#: themes/default/templates/partial/mail.js.ep:30
+#: themes/default/templates/partial/mail.js.ep:35
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Olá,\\n\\nAqui estão alguns ficheiros que gostaria de partilhar contigo:\\n"
 
@@ -348,7 +348,7 @@ msgid "Sending part XX1 of XX2. Please, be patient, the progress bar can take a
 msgstr "Envio do fragmento XX1 de XX2. Por favor aguarde, a barra de progressão pode levar algum tempo antes de avançar."
 
 #. (url_for('/')
-#: themes/default/templates/partial/mail.js.ep:43
+#: themes/default/templates/partial/mail.js.ep:48
 msgid "Share your files in total privacy on %1"
 msgstr "Partilhe os seus ficheiros com toda a privacidade em %1"
 
@@ -511,7 +511,7 @@ msgstr "entre %1 e %2, o ficheiro será conservado %3 dia(s) ;"
 msgid "between %1 and %2, the file will be kept forever."
 msgstr "entre %1 e %2, o ficheiro será conservado por um tempo indeterminado."
 
-#: themes/default/templates/partial/mail.js.ep:37
+#: themes/default/templates/partial/mail.js.ep:42
 msgid "deadline: "
 msgstr "Data-limite: "
 

themes/default/public/css/lufi.css

@@ -112,3 +112,107 @@ a.classic:focus {
     color: #9e9e9e;
     font-size: 1.5rem;
 }
+.white-background {
+    background-color: #FFF;
+}
+.width-0 { width: 0%; }
+.width-1 { width: 1%; }
+.width-2 { width: 2%; }
+.width-3 { width: 3%; }
+.width-4 { width: 4%; }
+.width-5 { width: 5%; }
+.width-6 { width: 6%; }
+.width-7 { width: 7%; }
+.width-8 { width: 8%; }
+.width-9 { width: 9%; }
+.width-10 { width: 10%; }
+.width-11 { width: 11%; }
+.width-12 { width: 12%; }
+.width-13 { width: 13%; }
+.width-14 { width: 14%; }
+.width-15 { width: 15%; }
+.width-16 { width: 16%; }
+.width-17 { width: 17%; }
+.width-18 { width: 18%; }
+.width-19 { width: 19%; }
+.width-20 { width: 20%; }
+.width-21 { width: 21%; }
+.width-22 { width: 22%; }
+.width-23 { width: 23%; }
+.width-24 { width: 24%; }
+.width-25 { width: 25%; }
+.width-26 { width: 26%; }
+.width-27 { width: 27%; }
+.width-28 { width: 28%; }
+.width-29 { width: 29%; }
+.width-30 { width: 30%; }
+.width-31 { width: 31%; }
+.width-32 { width: 32%; }
+.width-33 { width: 33%; }
+.width-34 { width: 34%; }
+.width-35 { width: 35%; }
+.width-36 { width: 36%; }
+.width-37 { width: 37%; }
+.width-38 { width: 38%; }
+.width-39 { width: 39%; }
+.width-40 { width: 40%; }
+.width-41 { width: 41%; }
+.width-42 { width: 42%; }
+.width-43 { width: 43%; }
+.width-44 { width: 44%; }
+.width-45 { width: 45%; }
+.width-46 { width: 46%; }
+.width-47 { width: 47%; }
+.width-48 { width: 48%; }
+.width-49 { width: 49%; }
+.width-50 { width: 50%; }
+.width-51 { width: 51%; }
+.width-52 { width: 52%; }
+.width-53 { width: 53%; }
+.width-54 { width: 54%; }
+.width-55 { width: 55%; }
+.width-56 { width: 56%; }
+.width-57 { width: 57%; }
+.width-58 { width: 58%; }
+.width-59 { width: 59%; }
+.width-60 { width: 60%; }
+.width-61 { width: 61%; }
+.width-62 { width: 62%; }
+.width-63 { width: 63%; }
+.width-64 { width: 64%; }
+.width-65 { width: 65%; }
+.width-66 { width: 66%; }
+.width-67 { width: 67%; }
+.width-68 { width: 68%; }
+.width-69 { width: 69%; }
+.width-70 { width: 70%; }
+.width-71 { width: 71%; }
+.width-72 { width: 72%; }
+.width-73 { width: 73%; }
+.width-74 { width: 74%; }
+.width-75 { width: 75%; }
+.width-76 { width: 76%; }
+.width-77 { width: 77%; }
+.width-78 { width: 78%; }
+.width-79 { width: 79%; }
+.width-80 { width: 80%; }
+.width-81 { width: 81%; }
+.width-82 { width: 82%; }
+.width-83 { width: 83%; }
+.width-84 { width: 84%; }
+.width-85 { width: 85%; }
+.width-86 { width: 86%; }
+.width-87 { width: 87%; }
+.width-88 { width: 88%; }
+.width-89 { width: 89%; }
+.width-90 { width: 90%; }
+.width-91 { width: 91%; }
+.width-92 { width: 92%; }
+.width-93 { width: 93%; }
+.width-94 { width: 94%; }
+.width-95 { width: 95%; }
+.width-96 { width: 96%; }
+.width-97 { width: 97%; }
+.width-98 { width: 98%; }
+.width-99 { width: 99%; }
+.width-100 { width: 100%; }

themes/default/public/js/filesize.min.js

@@ -1,6 +1,6 @@
 /*
- *  2015 Jason Mulligan
+ 2018 Jason Mulligan <jason.mulligan@avoidwork.com>
- *   @version 3.1.2
+ @version 3.6.1
- *    */
+*/
-"use strict";!function(a){var b=/b$/,c={bits:["B","kb","Mb","Gb","Tb","Pb","Eb","Zb","Yb"],bytes:["B","kB","MB","GB","TB","PB","EB","ZB","YB"]},d=function(a){var d=void 0===arguments[1]?{}:arguments[1],e=[],f=!1,g=0,h=void 0,i=void 0,j=void 0,k=void 0,l=void 0,m=void 0,n=void 0,o=void 0,p=void 0,q=void 0,r=void 0;if(isNaN(a))throw new Error("Invalid arguments");return j=d.bits===!0,p=d.unix===!0,i=void 0!==d.base?d.base:2,o=void 0!==d.round?d.round:p?1:2,q=void 0!==d.spacer?d.spacer:p?"":" ",r=void 0!==d.suffixes?d.suffixes:{},n=void 0!==d.output?d.output:"string",h=void 0!==d.exponent?d.exponent:-1,m=Number(a),l=0>m,k=i>2?1e3:1024,l&&(m=-m),0===m?(e[0]=0,e[1]=p?"":"B"):((-1===h||isNaN(h))&&(h=Math.floor(Math.log(m)/Math.log(k))),h>8&&(g=1e3*g*(h-8),h=8),g=2===i?m/Math.pow(2,10*h):m/Math.pow(1e3,h),j&&(g=8*g,g>k&&(g/=k,h++)),e[0]=Number(g.toFixed(h>0?o:0)),e[1]=c[j?"bits":"bytes"][h],!f&&p&&(j&&b.test(e[1])&&(e[1]=e[1].toLowerCase()),e[1]=e[1].charAt(0),"B"===e[1]?(e[0]=Math.floor(e[0]),e[1]=""):j||"k"!==e[1]||(e[1]="K"))),l&&(e[0]=-e[0]),e[1]=r[e[1]]||e[1],"array"===n?e:"exponent"===n?h:"object"===n?{value:e[0],suffix:e[1]}:e.join(q)};"undefined"!=typeof exports?module.exports=d:"function"==typeof define?define(function(){return d}):a.filesize=d}("undefined"!=typeof global?global:window);
+"use strict";!function(e){var i=/^(b|B)$/,t={iec:{bits:["b","Kib","Mib","Gib","Tib","Pib","Eib","Zib","Yib"],bytes:["B","KiB","MiB","GiB","TiB","PiB","EiB","ZiB","YiB"]},jedec:{bits:["b","Kb","Mb","Gb","Tb","Pb","Eb","Zb","Yb"],bytes:["B","KB","MB","GB","TB","PB","EB","ZB","YB"]}},o={iec:["","kibi","mebi","gibi","tebi","pebi","exbi","zebi","yobi"],jedec:["","kilo","mega","giga","tera","peta","exa","zetta","yotta"]};function b(e){var b,n,r,a,s,f,d,u,l,B,c,p,y,g=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},m=[],v=0,x=void 0,h=void 0;if(isNaN(e))throw new Error("Invalid arguments");return n=!0===g.bits,l=!0===g.unix,b=g.base||2,u=void 0!==g.round?g.round:l?1:2,B=void 0!==g.separator&&g.separator||"",c=void 0!==g.spacer?g.spacer:l?"":" ",y=g.symbols||g.suffixes||{},p=2===b&&g.standard||"jedec",d=g.output||"string",a=!0===g.fullform,s=g.fullforms instanceof Array?g.fullforms:[],x=void 0!==g.exponent?g.exponent:-1,f=(h=Number(e))<0,r=b>2?1e3:1024,f&&(h=-h),(-1===x||isNaN(x))&&(x=Math.floor(Math.log(h)/Math.log(r)))<0&&(x=0),x>8&&(x=8),0===h?(m[0]=0,m[1]=l?"":t[p][n?"bits":"bytes"][x]):(v=h/(2===b?Math.pow(2,10*x):Math.pow(1e3,x)),n&&(v*=8)>=r&&x<8&&(v/=r,x++),m[0]=Number(v.toFixed(x>0?u:0)),m[1]=10===b&&1===x?n?"kb":"kB":t[p][n?"bits":"bytes"][x],l&&(m[1]="jedec"===p?m[1].charAt(0):x>0?m[1].replace(/B$/,""):m[1],i.test(m[1])&&(m[0]=Math.floor(m[0]),m[1]=""))),f&&(m[0]=-m[0]),m[1]=y[m[1]]||m[1],"array"===d?m:"exponent"===d?x:"object"===d?{value:m[0],suffix:m[1],symbol:m[1]}:(a&&(m[1]=s[x]?s[x]:o[p][x]+(n?"bit":"byte")+(1===m[0]?"":"s")),B.length>0&&(m[0]=m[0].toString().replace(".",B)),m.join(c))}b.partial=function(e){return function(i){return b(i,e)}},"undefined"!=typeof exports?module.exports=b:"function"==typeof define&&define.amd?define(function(){return b}):e.filesize=b}("undefined"!=typeof window?window:global);
 //# sourceMappingURL=filesize.min.js.map

themes/default/public/js/filesize.min.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["filesize.js"],"names":["global","b","symbol","iec","bits","bytes","jedec","fullform","filesize","arg","base","ceil","full","fullforms","neg","output","round","unix","separator","spacer","standard","symbols","descriptor","arguments","length","undefined","result","val","e","num","isNaN","Error","suffixes","Array","exponent","Number","Math","floor","log","pow","toFixed","charAt","replace","test","value","suffix","toString","join","partial","opt","exports","module","define","amd","window"],"mappings":";;;;AAAA,cASA,SAAWA,GACV,IAAIC,EAAI,UACJC,GACHC,KACCC,MAAO,IAAK,MAAO,MAAO,MAAO,MAAO,MAAO,MAAO,MAAO,OAC7DC,OAAQ,IAAK,MAAO,MAAO,MAAO,MAAO,MAAO,MAAO,MAAO,QAE/DC,OACCF,MAAO,IAAK,KAAM,KAAM,KAAM,KAAM,KAAM,KAAM,KAAM,MACtDC,OAAQ,IAAK,KAAM,KAAM,KAAM,KAAM,KAAM,KAAM,KAAM,QAGrDE,GACHJ,KAAM,GAAI,OAAQ,OAAQ,OAAQ,OAAQ,OAAQ,OAAQ,OAAQ,QAClEG,OAAQ,GAAI,OAAQ,OAAQ,OAAQ,OAAQ,OAAQ,MAAO,QAAS,UAWrE,SAASE,EAASC,GACjB,IAKIC,EACAN,EACAO,EACAC,EACAC,EACAC,EAEAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EAlBAC,EAAaC,UAAUC,OAAS,QAAsBC,IAAjBF,UAAU,GAAmBA,UAAU,MAE5EG,KACAC,EAAM,EACNC,OAAI,EAOJC,OAAM,EASV,GAAIC,MAAMrB,GACT,MAAM,IAAIsB,MAAM,qBA4EjB,OAzEA3B,GAA2B,IAApBkB,EAAWlB,KAClBa,GAA2B,IAApBK,EAAWL,KAClBP,EAAOY,EAAWZ,MAAQ,EAC1BM,OAA6B,IAArBM,EAAWN,MAAmBM,EAAWN,MAAQC,EAAO,EAAI,EACpEC,OAAqC,IAAzBI,EAAWJ,WAAuBI,EAAWJ,WAAkB,GAC3EC,OAA+B,IAAtBG,EAAWH,OAAoBG,EAAWH,OAASF,EAAO,GAAK,IACxEI,EAAUC,EAAWD,SAAWC,EAAWU,aAC3CZ,EAAoB,IAATV,GAAaY,EAAWF,UAAsB,QACzDL,EAASO,EAAWP,QAAU,SAC9BH,GAA+B,IAAxBU,EAAWf,SAClBM,EAAYS,EAAWT,qBAAqBoB,MAAQX,EAAWT,aAC/De,OAA4B,IAAxBN,EAAWY,SAAsBZ,EAAWY,UAAY,EAE5DpB,GADAe,EAAMM,OAAO1B,IACD,EACZE,EAAOD,EAAO,EAAI,IAAO,KAGrBI,IACHe,GAAOA,KAIG,IAAPD,GAAYE,MAAMF,MACrBA,EAAIQ,KAAKC,MAAMD,KAAKE,IAAIT,GAAOO,KAAKE,IAAI3B,KAEhC,IACPiB,EAAI,GAKFA,EAAI,IACPA,EAAI,GAIO,IAARC,GACHH,EAAO,GAAK,EACZA,EAAO,GAAKT,EAAO,GAAKf,EAAOkB,GAAUhB,EAAO,OAAS,SAASwB,KAElED,EAAME,GAAgB,IAATnB,EAAa0B,KAAKG,IAAI,EAAO,GAAJX,GAAUQ,KAAKG,IAAI,IAAMX,IAE3DxB,IACHuB,GAAY,IAEDhB,GAAQiB,EAAI,IACtBD,GAAYhB,EACZiB,KAIFF,EAAO,GAAKS,OAAOR,EAAIa,QAAQZ,EAAI,EAAIZ,EAAQ,IAC/CU,EAAO,GAAc,KAAThB,GAAqB,IAANkB,EAAUxB,EAAO,KAAO,KAAOF,EAAOkB,GAAUhB,EAAO,OAAS,SAASwB,GAEhGX,IACHS,EAAO,GAAkB,UAAbN,EAAuBM,EAAO,GAAGe,OAAO,GAAKb,EAAI,EAAIF,EAAO,GAAGgB,QAAQ,KAAM,IAAMhB,EAAO,GAElGzB,EAAE0C,KAAKjB,EAAO,MACjBA,EAAO,GAAKU,KAAKC,MAAMX,EAAO,IAC9BA,EAAO,GAAK,MAMXZ,IACHY,EAAO,IAAMA,EAAO,IAIrBA,EAAO,GAAKL,EAAQK,EAAO,KAAOA,EAAO,GAG1B,UAAXX,EACIW,EAGO,aAAXX,EACIa,EAGO,WAAXb,GACM6B,MAAOlB,EAAO,GAAImB,OAAQnB,EAAO,GAAIxB,OAAQwB,EAAO,KAG1Dd,IACHc,EAAO,GAAKb,EAAUe,GAAKf,EAAUe,GAAKrB,EAASa,GAAUQ,IAAMxB,EAAO,MAAQ,SAAyB,IAAdsB,EAAO,GAAW,GAAK,MAGjHR,EAAUM,OAAS,IACtBE,EAAO,GAAKA,EAAO,GAAGoB,WAAWJ,QAAQ,IAAKxB,IAGxCQ,EAAOqB,KAAK5B,IAIpBX,EAASwC,QAAU,SAAUC,GAC5B,OAAO,SAAUxC,GAChB,OAAOD,EAASC,EAAKwC,KAKA,oBAAZC,QACVC,OAAOD,QAAU1C,EACW,mBAAX4C,QAAyBA,OAAOC,IACjDD,OAAO,WACN,OAAO5C,IAGRR,EAAOQ,SAAWA,EAjKpB,CAmKqB,oBAAX8C,OAAyBA,OAAStD","file":"filesize.min.js"}

themes/default/public/js/lufi-down.js

@@ -173,8 +173,12 @@ $(document).ready(function(){
         window.ws.onclose = function() {};
         window.ws.close();
         $('#please-wait, #loading, #pbd, #abort').remove();
-        $('#filesize').parent().append('<h4>'+i18n.aborted1+'</h4><a onClick="window.location.reload();" class="waves-effect waves-light btn">'+i18n.aborted2+'</a></p>');
+        $('#filesize').parent().append('<h4>'+i18n.aborted1+'</h4><a id="reloadLocation" class="waves-effect waves-light btn">'+i18n.aborted2+'</a></p>');
         window.onbeforeunload = null;
+        $('#reloadLocation').on('click', function(e) {
+            e.preventDefault();
+            window.location.reload();
+        })
     });
     $('#filesize').html(filesize($('#filesize').attr('data-filesize'), {base: 10}));
     window.a         = new Array();

themes/default/public/js/lufi-files.js

@@ -43,7 +43,8 @@ function itemExists(name) {
     }
 }
 
-function purgeExpired() {
+function purgeExpired(event) {
+    event.preventDefault();
     var files = JSON.parse(localStorage.getItem('files'));
 
     files.forEach(function(element, index, array) {
@@ -67,7 +68,8 @@ function purgeExpired() {
     });
 }
 
-function exportStorage() {
+function exportStorage(event) {
+    event.preventDefault();
     var a   = $('<a id="data-json">');
     a.hide();
     $('body').append(a);
@@ -122,6 +124,7 @@ function delFile() {
             } else {
                 alert(data.msg);
             }
+            evaluateMassDelete();
         },
         error: function() {
         },
@@ -140,7 +143,8 @@ function evaluateMassDelete() {
     }
 }
 
-function massDelete() {
+function massDelete(event) {
+    event.preventDefault();
     $('input[data-checked="data-checked"]').each(delFile);
 }
 
@@ -227,3 +231,8 @@ function populateFilesTable() {
         });
     });
 }
+
+function clickImport(event) {
+    event.preventDefault();
+    $('#import').click();
+}

themes/default/public/js/lufi-up.js

@@ -30,7 +30,8 @@ function copyToClipboard(txt) {
 }
 
 // Copy all links to clipboard
-function copyAllToClipboard() {
+function copyAllToClipboard(event) {
+    event.preventDefault();
     var text = new Array();
     var a = $('.link-input');
     var i;
@@ -49,9 +50,8 @@ function copyAllToClipboard() {
         var msg = successful ? i18n.copySuccess : i18n.copyFail;
         Materialize.toast(msg, 4000);
     } catch (err) {
-        textArea.css('width', '');
+        textArea.removeClass('textarea-hidden');
-        textArea.css('height', '');
+        textArea.addClass('white-background');
-        textArea.css('background', '#FFFFFF');
         alert(i18n.hits);
     }
 
@@ -149,7 +149,7 @@ function uploadFile(i, delay, del_at_first_view) {
     w.addClass('list-group-item');
     w.html(['<div class="card">',
                 '<div>',
-                    '<a href="#" onclick="destroyBlock(this);">',
+                    '<a href="#" id="destroy-', window.fc, '">',
                         '<i class="right mdi-navigation-close small"></i>',
                     '</a>',
                     '<div class="card-content">',
@@ -157,12 +157,16 @@ function uploadFile(i, delay, del_at_first_view) {
                         '<p id="parts-', window.fc, '"></p>',
                     '</div>',
                     '<div class="progress">',
-                        '<div id="progress-', window.fc, '" style="width: 0%;" data-key="', randomkey, '" data-name="', name, '" aria-valuemax="100" aria-valuemin="0" aria-valuenow="0" role="progressbar" class="determinate">',
+                        '<div id="progress-', window.fc, '" data-key="', randomkey, '" data-name="', name, '" aria-valuemax="100" aria-valuemin="0" aria-valuenow="0" role="progressbar" class="determinate width-0">',
                             '<span class="sr-only">', name, '0%</span>',
                         '</div>',
                     '</div>',
             '<div>'].join(''));
     r.append(w);
+    $('#destroy-'+window.fc).on('click', function(event) {
+        event.preventDefault();
+        destroyBlock(this)
+    });
 
     sliceAndUpload(randomkey, i, parts, 0, delay, del_at_first_view, null);
 }
@@ -280,18 +284,18 @@ function updateProgressBar(data) {
                                 '<a href="', url, '" target="_blank">',
                                     '<i class="mdi-file-file-download small" title="', i18n.dlText, '"></i>',
                                 '</a>',
-                                '<a href="#" onclick="copyToClipboard(\'', url, '\');" title="', i18n.cpText, '">',
+                                '<a href="#" id="copyurl-', window.fc, '" title="', i18n.cpText, '">',
                                     '<i class="mdi-content-content-copy small"></i>',
                                 '</a>',
                             '</span>',
-                            '<input id="', short, '" class="form-control link-input" value="', url, '" readonly="" type="text" style="background-color: #FFF;">',
+                            '<input id="', short, '" class="form-control link-input white-background" value="', url, '" readonly="" type="text">',
                             '<label class="active" for="', short, '">', i18n.dlText, '</label>',
                         '</div>',
                         '<div class="input-field">',
                             '<a href="', del_url, '" target="_blank" class="prefix big-prefix">',
                                 '<i class="mdi-action-delete small" title="', i18n.delText, '"></i>',
                             '</a>',
-                            '<input id="delete-', short, '" class="form-control" value="', del_url, '" readonly="" type="text" style="background-color: #FFF;">',
+                            '<input id="delete-', short, '" class="form-control white-background" value="', del_url, '" readonly="" type="text">',
                             '<label class="active" for="delete-', short, '">', i18n.delText, '</label>',
                         '</div>',
                     '</div>'].join(''));
@@ -303,13 +307,18 @@ function updateProgressBar(data) {
             p2.remove();
             p1.append(d);
 
+            $('#copyurl-'+window.fc).on('click', function(e) {
+                e.preventDefault();
+                copyToClipboard(url);
+            });
             $("input[type='text']").on("click", function () {
                 $(this).select();
             });
             // Add copy all and mailto buttons
             var misc = $('#misc');
             if (misc.html() === '') {
-                misc.html('<a href="#" onclick="copyAllToClipboard();" class="btn btn-info">'+i18n.copyAll+'</a> <a id="mailto" href="'+actionURL+'m?links='+links+'" class="btn btn-info">'+i18n.mailTo+'</a>');
+                misc.html('<a href="#" id="copyall" class="btn btn-info">'+i18n.copyAll+'</a> <a id="mailto" href="'+actionURL+'m?links='+links+'" class="btn btn-info">'+i18n.mailTo+'</a>');
+                $('#copyall').on('click', copyAllToClipboard);
             } else {
                 updateMailLink();
             }
@@ -333,7 +342,9 @@ function updateProgressBar(data) {
             j++;
             // Update progress bar
             var percent    = Math.round(100 * j/parts);
-            dp.css('width', percent+'%');
+            dp.removeClass();
+            dp.addClass('determinate');
+            dp.addClass('width-'+percent);
             dp.attr('aria-valuenow', percent);
 
             // Encrypt and upload next slice

themes/default/templates/files.html.ep

@@ -9,13 +9,13 @@
     <%= l('Rows in red mean that the files have expired and are no longer available.') %>
 </p>
 <div class="files-buttons">
-    <a href="#" onclick="exportStorage();" class="btn left-mg cyan"><%= l('Export localStorage data') %></a>
+    <a href="#" id="exportStorage" class="btn left-mg cyan"><%= l('Export localStorage data') %></a>
-    <a href="#" onclick="purgeExpired();" class="btn left-mg cyan"><%= l('Purge expired files from localStorage') %></a>
+    <a href="#" id="purgeExpired" class="btn left-mg cyan"><%= l('Purge expired files from localStorage') %></a>
-    <a href="#" onclick="$('#import').click();" class="btn left-mg cyan"><%= l('Import localStorage data') %></a>
+    <a href="#" id="clickImport" class="btn left-mg cyan"><%= l('Import localStorage data') %></a>
     <span class="file-field input-field">
         <input type="file" id="import" onchange="importStorage(this.files)">
     </span>
-    <a href="#" onclick="massDelete()" class="btn left-mg cyan disabled" id="mass-delete" disabled><%= l('Delete selected files') %></a>
+    <a href="#" class="btn left-mg cyan disabled" id="mass-delete" disabled><%= l('Delete selected files') %></a>
 </div>
 
 <div>

themes/default/templates/layouts/default.html.ep

@@ -24,7 +24,7 @@
         <nav class="cyan">
             <div class="nav-wrapper container">
                 <a href="<%= url_for('/') %>" class="brand-logo">&nbsp;<img src="<%= url_for('/img/lufi-min.png') %>" alt="logo"> Lufi</a>
-                <a href="#" data-activates="mobile-demo" class="button-collapse"><i class="mdi-navigation-menu"></i></a>
+                <a href="#" data-activates="mobile" class="button-collapse"><i class="mdi-navigation-menu"></i></a>
                 <ul id="nav-mobile" class="right hide-on-med-and-down">
                 % if ((!defined(config('ldap')) && !defined(config('htpasswd'))) || is_user_authenticated()) {
                     <li<%== ' class="active"' if (current_route eq 'index') %>><a href="<%= url_for('/') %>"><%= l('Upload files') %></a></li>
@@ -37,7 +37,7 @@
                     <li><a href="<%= url_for('/logout') %>"><%= l('Logout') %></a></li>
                 % }
                 </ul>
-                <ul id="mobile-demo" class="side-nav">
+                <ul id="mobile" class="side-nav">
                 % if ((!defined(config('ldap')) && !defined(config('htpasswd'))) || is_user_authenticated()) {
                     <li<%== ' class="active"' if (current_route eq 'index') %>><a href="<%= url_for('/') %>"><%= l('Upload files') %></a></li>
                     <li<%== ' class="active"' if (current_route eq 'files') %>><a href="<%= url_for('/files') %>"><%= l('My files') %></a></li>

themes/default/templates/partial/files.js.ep

@@ -12,5 +12,9 @@ var i18n       = {
 };
 $(document).ready(function() {
     populateFilesTable();
+    $('#exportStorage').on('click', exportStorage);
+    $('#purgeExpired').on('click', purgeExpired);
+    $('#clickImport').on('click', clickImport);
+    $('#mass-delete').on('click', massDelete);
 });
 

themes/default/templates/partial/mail.js.ep

@@ -23,9 +23,14 @@ function updateMailtoLink() {
 }
 function populateBody() {
     var links = [
+    % my $ref = ref(stash('links'));
+    % if ($ref eq 'ARRAY') {
     %   for my $link (@{stash('links')}) {
         '<%= $link %>',
     %   }
+    % } else {
+        '<%= stash('links') %>',
+    % }
     ];
     var text = "<%== l('Hello,\n\nHere\'s some files I want to share with you:\n') %>";
     links.forEach(function(name, index, array) {