fixing static paths to absolute, fixing csp script blueimp

fet_fotos.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=uWSGI Simple Sample for Flat Page with Index Default
+After=network.target
+
+[Service]
+#User=www-data
+#Group=www-data
+WorkingDirectory=/srv/flask-fet-fotos
+Environment="PATH=/srv/flask-fet-fotos/.env/bin"
+ExecStart=uwsgi --ini uwsgi.ini
+
+[Install]
+WantedBy=multi-user.target

foto_gallery/__init__.py

@@ -14,6 +14,7 @@ import os
 import re
 from PIL import Image, ExifTags, ImageOps
 from functools import partial
+from flask_csp.csp import csp_header, csp_default
 
 cfg = Config("config.cfg")
 
@@ -36,6 +37,9 @@ app.logger.info('flatpages loaded %d pages' % len(flatpages._pages))
 app.logger.info("Data directory is: %s" % flatpages.root)
 app.logger.info("Url prefix;: %s" % cfg.url_prefix)
 
+csp_d=csp_default()
+csp_d.update({'default-src':"'self' 'unsafe-inline'", 'script-src': "'unsafe-inline' 'self'"})
+
 
 
 freezer = Freezer(app)
@@ -83,6 +87,7 @@ def thumb(size=64,name=''):
 
 @page_blueprint.route('/<path:name>/',strict_slashes=False)
 @page_blueprint.route('/')
+@csp_header()
 def post(name=''):
     print("Post: %s" % name)
     page = flatpages.get(name)
@@ -98,12 +103,16 @@ def post(name=''):
         return send_from_directory(app.config["FLATPAGES_ROOT"],name)
     elif os.path.exists(os.path.join('static',name)):
         print("send from static dir %s" % name)
-        return send_from_directory('static',name)
+        return send_from_directory(os.path.abspath('static'),name)
     elif os.path.exists(os.path.join(cfg["fet_assets"],name)):
         return send_from_directory(cfg["fet_assets"],name)
+    elif os.path.exists(os.path.join("blueimp",name)):
+        return send_from_directory(os.path.abspath('blueimp'),name)
     else:
-        return send_from_directory('blueimp',name)
+        print("%s not found" % os.path.abspath(os.path.join('static',name)))
+        print("%s not found" % os.path.abspath(os.path.join(cfg["fet_assets"],name)))
         
+        return abort(404)
 
 @api_blueprint.route('/<path:name>.json',strict_slashes=False)
 @api_blueprint.route('/.json',strict_slashes=False)

foto_gallery/blueimp/.github/workflows/nodejs.yml

@@ -1,25 +0,0 @@
-name: Node CI
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [8.x, 10.x, 12.x]
-
-    steps:
-      - uses: actions/checkout@v1
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node-version }}
-      - name: npm install, build, and test
-        run: |
-          npm install
-          npm run build --if-present
-          npm test
-        env:
-          CI: true

foto_gallery/blueimp/.gitignore

@@ -1 +0,0 @@
-node_modules

foto_gallery/templates/gallery.html

@@ -1,5 +1,13 @@
 {# -*-jinja2-*- #}
 {% extends "layoutfetbs3.html" %}
+{% block head %}
+
+<script src="/galleries/js/blueimp-gallery.min.js"></script>
+<script src="/galleries/init.js"></script>
+
+
+{% endblock %}
+
 {% block content %}
 <h1>{{post.title}}</h1>
 <small> von {{post.author}} </small>
@@ -27,19 +35,9 @@
   </a>
   {% endfor %}
 </div>
-<script src="/galleries/js/blueimp-gallery.min.js"></script>
-<script>
-  document.getElementById('links').onclick = function(event) {
-  event = event || window.event
-  var target = event.target || event.srcElement,
-  link = target.src ? target.parentNode : target,
-  options = { index: link, event: event },
-  links = this.getElementsByTagName('a')
-  blueimp.Gallery(links, options)
-  }
-  </script>
-
-
 {% endif %}
 
+
+
+
 {% endblock %}

foto_gallery/templates/layoutfetbs3.html

@@ -12,7 +12,11 @@
     <link rel="stylesheet" href="/galleries/css/blueimp-gallery.min.css" />
 
 
-    <script src="https://www.fet.at/assets/application-7cbec5b180d121b587cfe58e2d4517d1.js" type="text/javascript"></script>
+    <script src="https://2020.fet.at/galleries/application-7cbec5b180d121b587cfe58e2d4517d1.js" type="text/javascript"></script>
+
+    {% block head %}
+	  {% endblock %}
+
     <title>Fetsite</title>
   </head>
 

static/init.js

@@ -0,0 +1,14 @@
+$(
+    function(){
+	console.log("init loaded")
+    })
+  $(function (){
+      document.getElementById('links').onclick = function(event) {
+  event = event || window.event
+  var target = event.target || event.srcElement,
+  link = target.src ? target.parentNode : target,
+  options = { index: link, event: event },
+  links = this.getElementsByTagName('a')
+  blueimp.Gallery(links, options)
+      }
+  })

static/test.txt

@@ -0,0 +1,2 @@
+DS
+ADSADQWF