Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update base.html #555

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Update base.html #555

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e28ab83
Update base.html
0x9404 Nov 13, 2024
782340f
Update user_activation_status.html
0x9404 Nov 13, 2024
d382079
Update root.html
0x9404 Nov 13, 2024
aed98aa
Update root.html
0x9404 Nov 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion templates/base.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>{{APPLICATION_NAME}}</title>
<link href="https://fonts.googleapis.com/css?family=Quicksand:300,400,500,700" rel="stylesheet">
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css">
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css" integrity="sha512-c8AIFmn4e0WZnaTOCXTOLzR+uIrTELY9AeIuUq6ODGaO619BjqG2rhiv/y6dIdmM7ba+CpzMRkkztMPXfVBm9g==" crossorigin="anonymous">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-datetimepicker/4.17.47/css/bootstrap-datetimepicker.min.css" />

{% compress css %}
Expand Down
4 changes: 2 additions & 2 deletions templates/common/user_activation_status.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Account Activation Status</title>
<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-gH2yIJqKdNHPEq0n4Mqa/HGKIhSkIHeL5AyhkYV8i59U5AR6csBvApHHNl/vI1Bx" crossorigin="anonymous">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/font/bootstrap-icons.css">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/font/bootstrap-icons.css" integrity="sha512-CaTMQoJ49k4vw9XO0VpTBpmMz8XpCWP5JhGmBvuBqCOaOHWENWO1CrVl09u4yp8yBVSID6smD4+gpzDJVQOPwQ==" crossorigin="anonymous">
<style>
.main_div{
height: 550px;
Expand Down Expand Up @@ -59,4 +59,4 @@
</center>
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js" integrity="sha384-A3rJD856KowSb7dwlZdYEkO39Gagi7vIsF0jrRAoQmDKKtQBHUuLZ9AsSv4jD4Xa" crossorigin="anonymous"></script>
</body>
</html>
</html>
24 changes: 12 additions & 12 deletions templates/root.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,13 @@
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>{{ settings.APPLICATION_NAME }}</title>
<link href="https://fonts.googleapis.com/css?family=Muli" rel="stylesheet">
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css">
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css" integrity="sha512-c8AIFmn4e0WZnaTOCXTOLzR+uIrTELY9AeIuUq6ODGaO619BjqG2rhiv/y6dIdmM7ba+CpzMRkkztMPXfVBm9g==" crossorigin="anonymous">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-datetimepicker/4.17.47/css/bootstrap-datetimepicker.min.css" />

<link href="https://cdn.quilljs.com/1.3.6/quill.snow.css" rel="stylesheet">
<link href="https://cdn.quilljs.com/1.3.6/quill.bubble.css" rel="stylesheet">
<link href="https://cdn.quilljs.com/1.3.6/quill.core.css" rel="stylesheet">

<link rel="stylesheet" href="https://cdn.quilljs.com/1.3.6/quill.snow.css" integrity="sha512-PVNMdkw+2UbxMaF03ZTxkRCySBl5QvZgSQPO0vuIpYIzb5h+Q18y8A/W/N4Vpo8EerHoi2DTZta/UxrdKPG0dA==" crossorigin="anonymous">
<link rel="stylesheet" href="https://cdn.quilljs.com/1.3.6/quill.bubble.css" integrity="sha512-TBuyUnhUYR9UZcz/PyP0xDJscrfgbNJa0HVWbJQULvLLpi0G2LOwZdOjk0GHrYji684ZBfczidVlVzd9a39+8Q==" crossorigin="anonymous">
<link rel="stylesheet" href="https://cdn.quilljs.com/1.3.6/quill.core.css" integrity="sha512-6BjEBJe1eABi9TLuhqxrROBDgcqw5S4sd/moV/8Qi1PwLmo//zD3gOVa2anLOwHuMudHURqfjT0Qt3ThLxvihw==" crossorigin="anonymous">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/css/select2.min.css" integrity="sha256-FdatTf20PQr/rWg+cAKfl6j4/IY3oohFAJ7gVC3M34E=" crossorigin="anonymous" />

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/selectize.js/0.12.6/css/selectize.bootstrap3.min.css">
Expand Down Expand Up @@ -144,10 +144,10 @@
<script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.24.0/moment-with-locales.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-datetimepicker/4.17.47/js/bootstrap-datetimepicker.min.js"></script>

<script defer src="https://use.fontawesome.com/releases/v5.12.1/js/all.js"></script>
<script src="https://use.fontawesome.com/releases/v5.12.1/js/all.js" integrity="sha512-xd+EFQjacRjTkapQNqqRNk8M/7kaek9rFqYMsbpEhTLdzq/3mgXXRXaz1u5rnYFH5mQ9cEZQjGFHFdrJX2CilA==" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.1/umd/popper.min.js"></script>

<script src="https://cdn.quilljs.com/1.3.6/quill.min.js"></script>
<script src="https://cdn.quilljs.com/1.3.6/quill.min.js" integrity="sha512-3OiXhM6bvRST0JlpR++aDMUh4n9QETHJdKEZ4U2gpDtyS8ZZF3h0072MaPDbjg/Q9W8Ki7G36Ay8I3xoUosPFg==" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery.blockUI/2.70/jquery.blockUI.min.js"></script>

<script src="{% static 'js/ajaxForm.js' %}"></script>
Expand All @@ -162,10 +162,10 @@
<script src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js" integrity="sha256-KM512VNnjElC30ehFwehXjx1YCHPiQkOPmqnrWtpccM=" crossorigin="anonymous"></script>

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery-tagsinput/1.3.6/jquery.tagsinput.min.js" integrity="sha256-IkytFcY/Z/rLvRE9rYyZvybaitAWr1y2jS/+eyxXky8=" crossorigin="anonymous"></script>
<script src="https://malsup.github.io/jquery.form.js"></script>

<script src="https://cdn.ckeditor.com/4.5.4/basic/ckeditor.js"></script>

<script src="https://malsup.github.io/jquery.form.js" integrity="sha512-Oi6cjDvQoNE5//zQpL9PIbAFg4I2hosC80Xnyoo0MQYOhvYHdfvgoAm/AR1/viXoiuo/7UpJIzCuabgYGtM89w==" crossorigin="anonymous"></script>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Use official CDN or self-host jQuery Form plugin

While the SRI implementation is correct, loading from malsup.github.io is not recommended as it's a personal GitHub page. Consider:

  1. Using the official CDN (cdnjs, jsdelivr, or unpkg)
  2. Self-hosting the file

This change would provide better reliability and security.

Example using cdnjs:

-<script src="https://malsup.github.io/jquery.form.js" integrity="sha512-Oi6cjDvQoNE5//zQpL9PIbAFg4I2hosC80Xnyoo0MQYOhvYHdfvgoAm/AR1/viXoiuo/7UpJIzCuabgYGtM89w==" crossorigin="anonymous"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery.form/4.3.0/jquery.form.min.js" integrity="sha512-YUkaLm+KJ5lQXDBdqBqk7EVhJAdxRnVdT2vtCzwPHSweCzyMgYV/tgGF4/dCyqtCC2eCphz0lRQgatGVdfR0ww==" crossorigin="anonymous"></script>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<script src="https://malsup.github.io/jquery.form.js" integrity="sha512-Oi6cjDvQoNE5//zQpL9PIbAFg4I2hosC80Xnyoo0MQYOhvYHdfvgoAm/AR1/viXoiuo/7UpJIzCuabgYGtM89w==" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery.form/4.3.0/jquery.form.min.js" integrity="sha512-YUkaLm+KJ5lQXDBdqBqk7EVhJAdxRnVdT2vtCzwPHSweCzyMgYV/tgGF4/dCyqtCC2eCphz0lRQgatGVdfR0ww==" crossorigin="anonymous"></script>

<script src="https://cdn.ckeditor.com/4.5.4/basic/ckeditor.js" integrity="sha512-R+19sqnzL8D6zFIft6a9ZpWdljtRbupgMOLSES67d7U7vuC8FBy8Aw0i/dI7Vt0bbg6RMPAl1FlTSrslycuhIg==" crossorigin="anonymous"></script>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codebase verification

⚠️ Potential issue

Critical: Update CKEditor version and implement secure configuration

The verification confirms CKEditor is used in multiple templates with minimal security configuration:

  • Using outdated version 4.5.4 (from 2015) while current version is 4.22.x
  • Basic preset lacks important security features
  • No explicit security configurations found in the initialization code

Action items:

  1. Upgrade to latest CKEditor 4.22.x for critical security patches
  2. Switch to Standard/Full preset for enhanced security features
  3. Add security-focused configuration:
    • Enable ACF (Advanced Content Filter)
    • Configure allowed content rules
    • Enable CSRF protection
🔗 Analysis chain

Critical: Update CKEditor version and consider security preset

Two important security considerations:

  1. CKEditor 4.5.4 is significantly outdated (current is 4.22.x) and may have known vulnerabilities
  2. The 'basic' preset might be missing security features available in Standard/Full presets

Consider:

  1. Upgrading to the latest version
  2. Evaluating if the 'basic' preset provides sufficient security for your use case

Let me analyze the CKEditor usage patterns and security configurations in the codebase to provide a more comprehensive verification of the concerns.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check for known vulnerabilities in CKEditor 4.5.4
gh api graphql -f query='
{
  securityVulnerabilities(first: 5, ecosystem: NPM, package: "ckeditor", range: "4.5.4") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Length of output: 767

Script:

#!/bin/bash
# Search for CKEditor usage and configuration in the codebase
rg -l "ckeditor" --type html --type js

# Check if there are any security-related configurations or documentation
rg -i "ckeditor.*security|security.*ckeditor" --type html --type js --type md

# Look for any CKEditor initialization or configuration code
ast-grep --pattern 'CKEDITOR.replace($$$)'

Length of output: 735

<script src="{% static 'js/bootstrap-suggest.js' %}"></script>

{% block js_block %}{% endblock js_block %}
Expand Down Expand Up @@ -205,4 +205,4 @@
</script>
</body>

</html>
</html>