2009-06-11 18:05:05 +00:00
|
|
|
<%
|
|
|
|
|
/*
|
|
|
|
|
* This should be included inside <head>...</head>,
|
|
|
|
|
* as it sets the stylesheet.
|
2009-08-20 14:35:32 +00:00
|
|
|
*
|
|
|
|
|
* This is included almost 30 times, so keep whitespace etc. to a minimum.
|
2009-06-11 18:05:05 +00:00
|
|
|
*/
|
|
|
|
|
|
2009-08-20 22:22:07 +00:00
|
|
|
// http://www.crazysquirrel.com/computing/general/form-encoding.jspx
|
|
|
|
|
if (request.getCharacterEncoding() == null)
|
|
|
|
|
request.setCharacterEncoding("UTF-8");
|
|
|
|
|
|
2011-03-19 18:34:39 +00:00
|
|
|
// Now that we use POST for most forms, these prevent the back button from working after a form submit
|
|
|
|
|
// Just let the browser do its thing
|
|
|
|
|
//response.setHeader("Pragma", "no-cache");
|
|
|
|
|
//response.setHeader("Cache-Control","no-cache");
|
|
|
|
|
//response.setDateHeader("Expires", 0);
|
|
|
|
|
|
2009-06-11 18:05:05 +00:00
|
|
|
// the above will b0rk if the servlet engine has already flushed
|
2009-08-15 16:08:33 +00:00
|
|
|
// the response prior to including this file, so it should be
|
2009-06-11 18:05:05 +00:00
|
|
|
// near the top
|
2009-08-15 16:08:33 +00:00
|
|
|
|
2018-07-28 19:03:01 +00:00
|
|
|
String i2pcontextId = request.getParameter("i2p.contextId");
|
|
|
|
|
try {
|
|
|
|
|
if (i2pcontextId != null) {
|
|
|
|
|
session.setAttribute("i2p.contextId", i2pcontextId);
|
|
|
|
|
} else {
|
|
|
|
|
i2pcontextId = (String) session.getAttribute("i2p.contextId");
|
|
|
|
|
}
|
|
|
|
|
} catch (IllegalStateException ise) {}
|
2020-05-02 10:38:37 +00:00
|
|
|
|
2018-11-13 17:48:58 +00:00
|
|
|
%><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
2009-10-23 13:55:44 +00:00
|
|
|
<jsp:useBean class="net.i2p.router.web.CSSHelper" id="intl" scope="request" />
|
2020-05-02 10:38:37 +00:00
|
|
|
<jsp:setProperty name="intl" property="contextId" value="<%=i2pcontextId%>" /><%
|
|
|
|
|
|
2018-03-09 16:02:00 +00:00
|
|
|
response.setHeader("Accept-Ranges", "none");
|
|
|
|
|
|
2019-12-25 12:18:00 +00:00
|
|
|
String cspNonce = Integer.toHexString(net.i2p.util.RandomSource.getInstance().nextInt());
|
|
|
|
|
|
2012-05-13 13:05:17 +00:00
|
|
|
// clickjacking
|
2014-07-26 09:32:26 +00:00
|
|
|
if (intl.shouldSendXFrame()) {
|
2012-05-13 13:05:17 +00:00
|
|
|
response.setHeader("X-Frame-Options", "SAMEORIGIN");
|
2019-12-25 12:18:00 +00:00
|
|
|
// unsafe-inline is a fallback for browsers not supporting nonce
|
|
|
|
|
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
|
2025-04-08 12:56:04 +00:00
|
|
|
// we need unsafe-inline for the /netdb SVG
|
|
|
|
|
if ("/netdb.jsp".equals(request.getServletPath()))
|
|
|
|
|
response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; media-src 'none'");
|
|
|
|
|
else
|
|
|
|
|
response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'nonce-" + cspNonce + "'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; media-src 'none'");
|
2014-07-26 09:32:26 +00:00
|
|
|
}
|
2021-06-18 09:58:57 -04:00
|
|
|
response.setHeader("X-XSS-Protection", "1; mode=block");
|
|
|
|
|
response.setHeader("X-Content-Type-Options", "nosniff");
|
2024-06-26 11:45:29 -04:00
|
|
|
response.setHeader("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), fullscreen=(self), geolocation=(), gyroscope=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), vibrate=(), vr=()");
|
2016-12-23 12:35:41 +00:00
|
|
|
// https://www.w3.org/TR/referrer-policy/
|
|
|
|
|
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
|
|
|
|
|
// As of Chrome 56, Firefox 50, Opera 43. "same-origin" not widely supported.
|
|
|
|
|
response.setHeader("Referrer-Policy", "no-referrer");
|
2012-05-13 13:05:17 +00:00
|
|
|
|
2011-03-08 03:07:02 +00:00
|
|
|
String conNonceParam = request.getParameter("consoleNonce");
|
2015-10-17 17:38:57 +00:00
|
|
|
if (net.i2p.router.web.CSSHelper.getNonce().equals(conNonceParam)) {
|
2011-03-08 03:07:02 +00:00
|
|
|
intl.setLang(request.getParameter("lang"));
|
2011-11-09 18:38:39 +00:00
|
|
|
intl.setNews(request.getParameter("news"));
|
2021-09-30 09:55:35 -04:00
|
|
|
intl.setTheme(request.getParameter("theme"));
|
2011-03-08 03:07:02 +00:00
|
|
|
}
|
2021-09-30 09:55:35 -04:00
|
|
|
// used several times below
|
|
|
|
|
String theUserAgent = request.getHeader("User-Agent");
|
|
|
|
|
String theThemePath = intl.getTheme(theUserAgent);
|
|
|
|
|
%><link rel="icon" href="<%=theThemePath%>images/favicon.ico">
|
|
|
|
|
<link id="pagestyle" href="<%=theThemePath%>console.css?<%=net.i2p.CoreVersion.VERSION%>" rel="stylesheet" type="text/css">
|
2009-10-22 22:25:53 +00:00
|
|
|
<%
|
2023-11-02 15:24:08 -04:00
|
|
|
String curlang = intl.getLang();
|
2024-11-26 12:15:32 -05:00
|
|
|
if (curlang.equals("zh") || curlang.equals("gan")) {
|
2011-06-26 19:07:01 +00:00
|
|
|
// make the fonts bigger for chinese
|
2020-05-02 10:38:37 +00:00
|
|
|
%><link href="<%=theThemePath%>console_big.css?<%=net.i2p.CoreVersion.VERSION%>" rel="stylesheet" type="text/css">
|
2009-10-22 22:25:53 +00:00
|
|
|
<%
|
2023-11-02 15:24:08 -04:00
|
|
|
} else if (curlang.equals("ar") || curlang.equals("fa")) {
|
|
|
|
|
// Use RTL theme for Arabic and Persian
|
2020-05-02 10:38:37 +00:00
|
|
|
%><link href="<%=theThemePath%>console_ar.css?<%=net.i2p.CoreVersion.VERSION%>" rel="stylesheet" type="text/css">
|
2013-01-19 03:42:54 +00:00
|
|
|
<%
|
|
|
|
|
}
|
2020-05-02 10:38:37 +00:00
|
|
|
if (!intl.allowIFrame(theUserAgent)) {
|
2018-11-13 17:48:58 +00:00
|
|
|
%><meta name="viewport" content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" />
|
2020-05-02 10:38:37 +00:00
|
|
|
<link href="<%=theThemePath%>mobile.css?<%=net.i2p.CoreVersion.VERSION%>" rel="stylesheet" type="text/css">
|
2011-06-20 16:27:58 +00:00
|
|
|
<%
|
|
|
|
|
}
|
2020-08-24 17:15:40 +00:00
|
|
|
%>
|
