Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secure headers, reduce static content size #302

Closed
wants to merge 5 commits into from

Conversation

Hellowlol
Copy link
Contributor

  • This pr is about reducing size of the stuff that gets loaded, like images/css/js etc and to make htpc manager a little more secure against xss attacks.
  • Auth is disabled for all static content.
  • Remove some unneeded code

Closes #272

This is just to clean up some of the issues that should be closed:
Closes #279
Closes #284
Closes #236
Closes #235
Closes #171
Closes #166
Closes #162
Closes #144 i cant find any ref to the missing image in the code now
Closes #126 Works fine now
Closes #122

data=attr;}
object=getObject(data.indexOf("{")<0?"{"+data+"}":data);}
$.data(elem,settings.single,object);return object;}}});$.fn.metadata=function(opts){return $.metadata.get(this[0],opts);};})(jQuery)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minimized JS should not be included, since it can't be modified.
Instead, a script should be given to minify (or compile) source at first launch.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cant see the problem, why would js librarys be modyfyed? It makes no sense.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just because of their license. GPL enforces the fact that you should be able to modify them.
Yes, it's the open-source thing. But usually, a simple Makefile with a call to a minifier should do the trick

@Hellowlol
Copy link
Contributor Author

Seems like nonsense, it's still possible to modify a file even if it's minified. If that's a problem I can replace the files I have minified with the authors own minified file..

@Glandos
Copy link

Glandos commented Oct 19, 2014

OK, I understand this is a hard debate that triggered a lot of flame wars. But no, a minified file is not a source file. It is like a compiled binary. I can modify a binary using an hex editor, however, providing a compiled binary is not releasing a software as open-sourced.
I totally understand the reason of minified JS. But in the source tree, they should be plain text. If someone wants to launch the software, it is not hard to add a one-time step that minify it.

I'm sorry to be so much a pain, but minified script are complicated to handle: it's difficult to compare them with their original source to know if they were not altered for example.

@Hellowlol
Copy link
Contributor Author

Feel free to send a pr regarding the makefile, I cba. @styxit feel free to close this.

@madclicker
Copy link

This is a good idea!

I took the liberty of grabbing your minified versions.

I've been in the foss game for well over 15 years:

http://www.who.is/whois/openscripts.com

and this is the stupidest thing I've ever heard, and believe me, I've heard plenty of stupid shit said!

@Hellowlol
Copy link
Contributor Author

@madclicker great, I was gonna push this to pytunes aswell

@Glandos
Copy link

Glandos commented Oct 19, 2014

https://lists.debian.org/debian-devel/2014/03/msg00190.html
and especially this answer: https://lists.debian.org/debian-devel/2014/03/msg00204.html
As you can see, the topic is really long.
One can say that this is good or bad. But thinking this question is stupid in itself means that you have no way to be packaged one day.
May be you don't mind…

@Hellowlol
Copy link
Contributor Author

I know nothing about about licenses. I can google tho https://www.gnu.org/licenses/javascript-labels.html. I just don't care. The file you dropped the note about was dual licensed with mit so I hope I can just add license info at the top.

@madclicker
Copy link

FOSS is not about formatting. Hellowlol only reformatted the originals. The original formatted source is still available.

@Hellowlol What did you use to minify the js? Does it work for css? I think after the project reaches stability this would be good for all js and css TEXT files.

@Hellowlol
Copy link
Contributor Author

I just grabbed the optimized version that pagespeed linked to and manually pasted that into the file. (To keep version info etc). I have no idea, we should use some other tool where this can be automated on run time.

@styxit
Copy link
Owner

styxit commented Oct 20, 2014

Very often my requests take a long time, so gaining some performance is something i would like to achieve and think this is a good start.

About the licences for JS libraries; Maybe we should include the original source and a minified version, and only use the minified version?

@Hellowlol
Copy link
Contributor Author

Can do :)

@Glandos
Copy link

Glandos commented Oct 20, 2014

@styxit No problem. After all, I've just checked your license, and you're on MIT. Since jQuery is also on MIT (and on GPL, but you can chose the one you prefer), I think it should be OK to have both side by side (jquery.js.dist for example).

Sorry for the noise. I just wanted to avoid a future trouble, but I am clearly not on duty to hunt this issues 😉

HTPC-manager is a great software, and I'm still using it anyway!

@Hellowlol Hellowlol closed this Nov 5, 2014
@Hellowlol Hellowlol deleted the opt branch November 29, 2014 02:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment