From a4a32f6b9e0213797ad43b9b458dbd5fbc86614b Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 20 Jun 2021 08:43:44 +0200 Subject: [PATCH 01/78] switch to streaming WASM loading, fixes #814 --- js/zlib-1.2.11.js | 57 ++++++++++++++++++++--------------------------- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 3 files changed, 26 insertions(+), 35 deletions(-) diff --git a/js/zlib-1.2.11.js b/js/zlib-1.2.11.js index ed0abea8..835cb968 100644 --- a/js/zlib-1.2.11.js +++ b/js/zlib-1.2.11.js @@ -1,6 +1,6 @@ 'use strict'; -(function() { +(function () { let ret; async function initialize() { @@ -23,16 +23,7 @@ _abort: errno => { console.error(`Error: ${errno}`) }, _grow: () => { }, }; - - let buff; - if (typeof fetch === 'undefined') { - buff = fs.readFileSync('zlib-1.2.11.wasm'); - } else { - const resp = await fetch('js/zlib-1.2.11.wasm'); - buff = await resp.arrayBuffer(); - } - const module = await WebAssembly.compile(buff); - const ins = await WebAssembly.instantiate(module, { env }); + const ins = await WebAssembly.instantiateStreaming(fetch('js/zlib-1.2.11.wasm'), { env }); const srcPtr = ins.exports._malloc(CHUNK_SIZE); const dstPtr = ins.exports._malloc(CHUNK_SIZE); @@ -116,28 +107,28 @@ } ret = { - inflate(rawDeflateBuffer) { - const rawInf = new RawInf(); - for (let offset = 0; offset < rawDeflateBuffer.length; offset += CHUNK_SIZE) { - const end = Math.min(offset + CHUNK_SIZE, rawDeflateBuffer.length); - const chunk = rawDeflateBuffer.subarray(offset, end); - rawInf.inflate(chunk); - } - const ret = rawInf.getBuffer(); - rawInf.destroy(); - return ret; - }, - deflate(rawInflateBuffer) { - const rawDef = new RawDef(); - for (let offset = 0; offset < rawInflateBuffer.length; offset += CHUNK_SIZE) { - const end = Math.min(offset + CHUNK_SIZE, rawInflateBuffer.length); - const chunk = rawInflateBuffer.subarray(offset, end); - rawDef.deflate(chunk, rawInflateBuffer.length <= offset + CHUNK_SIZE); - } - const ret = rawDef.getBuffer(); - rawDef.destroy(); - return ret; - }, + inflate(rawDeflateBuffer) { + const rawInf = new RawInf(); + for (let offset = 0; offset < rawDeflateBuffer.length; offset += CHUNK_SIZE) { + const end = Math.min(offset + CHUNK_SIZE, rawDeflateBuffer.length); + const chunk = rawDeflateBuffer.subarray(offset, end); + rawInf.inflate(chunk); + } + const ret = rawInf.getBuffer(); + rawInf.destroy(); + return ret; + }, + deflate(rawInflateBuffer) { + const rawDef = new RawDef(); + for (let offset = 0; offset < rawInflateBuffer.length; offset += CHUNK_SIZE) { + const end = Math.min(offset + CHUNK_SIZE, rawInflateBuffer.length); + const chunk = rawInflateBuffer.subarray(offset, end); + rawDef.deflate(chunk, rawInflateBuffer.length <= offset + CHUNK_SIZE); + } + const ret = rawDef.getBuffer(); + rawDef.destroy(); + return ret; + }, } return ret; diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 1e4eae00..86c15de2 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -54,7 +54,7 @@ if ($ZEROBINCOMPATIBILITY) : - + diff --git a/tpl/page.php b/tpl/page.php index 28f37b90..f3b26d4e 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -33,7 +33,7 @@ if ($ZEROBINCOMPATIBILITY): - + Date: Sun, 20 Jun 2021 08:44:25 +0200 Subject: [PATCH 02/78] remove unsafe-eval from CSP --- cfg/conf.sample.php | 2 +- lib/Configuration.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/cfg/conf.sample.php b/cfg/conf.sample.php index d362f3f2..bfae7563 100644 --- a/cfg/conf.sample.php +++ b/cfg/conf.sample.php @@ -87,7 +87,7 @@ languageselection = false ; async functions and display an error if not and for Chrome to enable ; webassembly support (used for zlib compression). You can remove it if Chrome ; doesn't need to be supported and old browsers don't need to be warned. -; cspheader = "default-src 'none'; base-uri 'self'; form-action 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval' resource:; style-src 'self'; font-src 'self'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads" +; cspheader = "default-src 'none'; base-uri 'self'; form-action 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' resource:; style-src 'self'; font-src 'self'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads" ; stay compatible with PrivateBin Alpha 0.19, less secure ; if enabled will use base64.js version 1.7 instead of 2.1.9 and sha1 instead of diff --git a/lib/Configuration.php b/lib/Configuration.php index 7c4eb106..35e5b40f 100644 --- a/lib/Configuration.php +++ b/lib/Configuration.php @@ -54,7 +54,7 @@ class Configuration 'urlshortener' => '', 'qrcode' => true, 'icon' => 'identicon', - 'cspheader' => 'default-src \'none\'; base-uri \'self\'; form-action \'none\'; manifest-src \'self\'; connect-src * blob:; script-src \'self\' \'unsafe-eval\' resource:; style-src \'self\'; font-src \'self\'; img-src \'self\' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads', + 'cspheader' => 'default-src \'none\'; base-uri \'self\'; form-action \'none\'; manifest-src \'self\'; connect-src * blob:; script-src \'self\' resource:; style-src \'self\'; font-src \'self\'; img-src \'self\' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads', 'zerobincompatibility' => false, 'httpwarning' => true, 'compression' => 'zlib', From 1a51c0973dcd92bed25eaba5d055881e0715c3a3 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Thu, 12 Sep 2024 07:50:52 +0200 Subject: [PATCH 03/78] bootstrap improvements, fixes #1392 - remove unused styles (no IDs called preview or comments) - replace margins & paddings with bootstrap utility classes - apply min body height to placeholder, plaintext & prettymessage, to move footer to end of viewport --- CHANGELOG.md | 1 + css/bootstrap/privatebin.css | 8 ++------ css/bootstrap5/privatebin.css | 15 +-------------- tpl/bootstrap5.php | 6 +++--- 4 files changed, 7 insertions(+), 23 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 45316680..2455d1f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## 1.7.5 (not yet released) * ADDED: Allow non persistent SQL connections, if configured (#1394) +* CHANGED: Various tweaks of the `bootstrap` & `bootstrap5` templates (#1392) * CHANGED: Simpler PostgreSQL table lookup query (#1361) * CHANGED: SRI hashes are now configurable, no longer hardcoded in templates (#1365) * CHANGED: Upgrading libraries to: DOMpurify 3.1.6 diff --git a/css/bootstrap/privatebin.css b/css/bootstrap/privatebin.css index a7c0f188..84b704e8 100644 --- a/css/bootstrap/privatebin.css +++ b/css/bootstrap/privatebin.css @@ -87,8 +87,8 @@ body.loading { word-wrap: break-word; } -#preview { - margin-bottom: 10px; +#message, #placeholder, #plaintext, #prettymessage { + height: 70vh; } #message, .replymessage { @@ -100,10 +100,6 @@ body.loading { margin: 5px 0; } -#comments, #comments button { - margin-bottom: 10px; -} - .comment { border-left: 1px solid #ccc; padding: 5px 0 5px 10px; diff --git a/css/bootstrap5/privatebin.css b/css/bootstrap5/privatebin.css index b14768a1..9a726bb5 100644 --- a/css/bootstrap5/privatebin.css +++ b/css/bootstrap5/privatebin.css @@ -32,11 +32,7 @@ word-wrap: break-word; } -#preview { - margin-bottom: 10px; -} - -#message { +#message, #placeholder, #plaintext, #prettymessage { height: 70vh; } @@ -45,17 +41,8 @@ resize: vertical; } -#nickname { - margin: 5px 0; -} - -#comments, #comments button { - margin-bottom: 10px; -} - .comment { border-left: 1px solid #ccc; - padding: 5px 0 5px 10px; transition: background-color 0.75s ease-out; } diff --git a/tpl/bootstrap5.php b/tpl/bootstrap5.php index 298c1684..0f7b5708 100644 --- a/tpl/bootstrap5.php +++ b/tpl/bootstrap5.php @@ -467,7 +467,7 @@ if ($DISCUSSION) : ?>