kantarciandClaude Opus 5
a434e0cefc
Fonts were still reachable from Google in two places. The editor and area previews were handed `googleFonts` and no `localFonts`, so the screen used most of the day fetched Lato from fonts.googleapis.com on every open; the public page fell back to the same link whenever the files were missing. Neither path remains: the template has no Google branch, `googleFontsUrl()` is gone, and the policies name no foreign font host - `font-src 'self'` publicly, `style-src 'self'; font-src 'self'` in administration. Without local files a site now shows the theme's fallback and says so. Preloading took the first two weights per family. The Kant-IT theme names Lato 400, 700 and 900 and sets its headings on 800/900, so the one weight that carried them loaded after the stylesheet and `font-display:swap` swapped the heading in plain sight. Every weight of the theme is preloaded now, latin subset, and the links sit before the stylesheet: measured cold, all three files finish at 168 ms against a first paint at 292 ms. Open tasks no longer hide on the screen that owns them. A strip above every management screen names what needs a button and carries it: a new version leads to System, missing fonts to Design. Neither asks the network - the version comes from the daily update-check task, the fonts from a look in the folder. System and update was unusable on a phone: `.stack` is a grid whose automatic column grows to its widest content, and one long database path pushed the page sideways. It gets `minmax(0, 1fr)`, the backup table stacks below 620px, and the prose is 45% shorter with the fine print folded away. The device chips drew the current device with an outline, which lies outside the box, ran under its neighbour and was clipped by the sidebar - it read as a cut-off red frame. Used devices are filled in `#9d4e0d` now (5.6:1), the current one carries a border inside the chip. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
63 lines
2.8 KiB
PHP
63 lines
2.8 KiB
PHP
<?php
|
|
|
|
namespace App\EventSubscriber;
|
|
|
|
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
|
|
use Symfony\Component\HttpKernel\Event\RequestEvent;
|
|
use Symfony\Component\HttpKernel\Event\ResponseEvent;
|
|
use Symfony\Component\HttpKernel\KernelEvents;
|
|
|
|
final class AdminHeadersSubscriber implements EventSubscriberInterface
|
|
{
|
|
public function __construct(private string $adminPath)
|
|
{
|
|
}
|
|
|
|
public static function getSubscribedEvents(): array
|
|
{
|
|
return [KernelEvents::REQUEST => ['onRequest', 300], KernelEvents::RESPONSE => ['onResponse', -300]];
|
|
}
|
|
|
|
private function isAdmin(string $path): bool
|
|
{
|
|
return 1 === preg_match('#^/'.preg_quote($this->adminPath, '#').'(?:/|$)#', $path);
|
|
}
|
|
|
|
/**
|
|
* One value per administration page, for the single inline script there is: the import map.
|
|
*
|
|
* It has to be inline - the specification knows no external import maps - and it has to work
|
|
* under `script-src 'self'`. Without it the map is dropped without a word, the modules load
|
|
* without a version key, and a year-old `editor-model.js` out of the cache meets a new
|
|
* `editor.js`. That is not a theory: it broke the editor after 1.5.0 went out.
|
|
*/
|
|
public function onRequest(RequestEvent $event): void
|
|
{
|
|
$request = $event->getRequest();
|
|
if (!$event->isMainRequest() || !$this->isAdmin($request->getPathInfo())) {
|
|
return;
|
|
}
|
|
$request->attributes->set('csp_nonce', rtrim(strtr(base64_encode(random_bytes(16)), '+/', '-_'), '='));
|
|
}
|
|
|
|
public function onResponse(ResponseEvent $event): void
|
|
{
|
|
if (!$this->isAdmin($event->getRequest()->getPathInfo())) {
|
|
return;
|
|
}
|
|
$headers = $event->getResponse()->headers;
|
|
$headers->set('Cache-Control', 'private, no-store');
|
|
$headers->set('X-Robots-Tag', 'noindex, nofollow');
|
|
$headers->set('X-Content-Type-Options', 'nosniff');
|
|
$headers->set('Referrer-Policy', 'same-origin');
|
|
$headers->set('Permissions-Policy', 'accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), microphone=(), payment=(), usb=()');
|
|
// Die Vorschau zeigt dieselbe Schrift wie die veroeffentlichte Seite - und die liegt,
|
|
// genau wie dort, auf diesem Server. Fremde Schrifthosts braucht sie nicht.
|
|
// The nonce only ever adds the one script it names; 'self' keeps applying to everything
|
|
// else, so nothing is loosened by it.
|
|
$nonce = $event->getRequest()->attributes->get('csp_nonce');
|
|
$script = is_string($nonce) && '' !== $nonce ? sprintf("'self' 'nonce-%s'", $nonce) : "'self'";
|
|
$headers->set('Content-Security-Policy', "default-src 'self'; script-src {$script}; style-src 'self'; font-src 'self'; img-src 'self' https:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'");
|
|
}
|
|
}
|