diff --git a/doc/advanced.rst b/doc/advanced.rst index 2f3dcba10c..56b361b8cd 100644 --- a/doc/advanced.rst +++ b/doc/advanced.rst @@ -37,6 +37,10 @@ of how to configure Flask-Admin to inject CSP nonce values:: app, content_security_policy={ "default-src": "'self'", + "script-src": "'self'", + "style-src": "'self' 'unsafe-inline' fonts.googleapis.com ", + "font-src": "'self' fonts.gstatic.com data: ", + "img-src": "'self' data: ", }, content_security_policy_nonce_in=["script-src", "style-src"] ) diff --git a/flask_admin/form/widgets.py b/flask_admin/form/widgets.py index eb4e858b39..d2af836bb4 100644 --- a/flask_admin/form/widgets.py +++ b/flask_admin/form/widgets.py @@ -107,12 +107,20 @@ def __init__(self, template: str) -> None: self.template = template def __call__(self, field: Field, **kwargs: t.Any) -> str: + admin = h.g._admin_view.admin + admin_csp_nonce_attribute = ( + Markup(f'nonce="{admin.csp_nonce_generator()}"') + if admin.csp_nonce_generator + else "" + ) + kwargs.update( { "field": field, "_gettext": gettext, "_ngettext": ngettext, "h": h, + "admin_csp_nonce_attribute": admin_csp_nonce_attribute, } ) diff --git a/flask_admin/static/admin/js/helpers.js b/flask_admin/static/admin/js/helpers.js index bf8d2601ee..fd51499a60 100644 --- a/flask_admin/static/admin/js/helpers.js +++ b/flask_admin/static/admin/js/helpers.js @@ -9,4 +9,10 @@ } } }; + + $('.a-unlink').on('click', function(e) { + console.log('click a-unlink'); + e.preventDefault(); + }); + })(); diff --git a/flask_admin/templates/bootstrap4/admin/actions.html b/flask_admin/templates/bootstrap4/admin/actions.html index 89899089b8..f94bf6236a 100644 --- a/flask_admin/templates/bootstrap4/admin/actions.html +++ b/flask_admin/templates/bootstrap4/admin/actions.html @@ -1,16 +1,29 @@ {% import 'admin/static.html' as admin_static with context %} {% macro dropdown(actions, btn_class='nav-link dropdown-toggle') -%} -
{% for p in actions %} - {{ _gettext(p[1]) }} + {{ _gettext(p[1]) }} {% endfor %}
+ + {% endmacro %} + {% macro form(actions, url) %} {% if actions %}
diff --git a/flask_admin/templates/bootstrap4/admin/file/list.html b/flask_admin/templates/bootstrap4/admin/file/list.html index dc9be0191f..341e2d9198 100644 --- a/flask_admin/templates/bootstrap4/admin/file/list.html +++ b/flask_admin/templates/bootstrap4/admin/file/list.html @@ -89,7 +89,8 @@ {% if delete_form.csrf_token is defined and delete_form.csrf_token %} {{ delete_form.csrf_token }} {% endif %} -
@@ -100,7 +101,8 @@ {% if delete_form.csrf_token is defined and delete_form.csrf_token %} {{ delete_form.csrf_token }} {% endif %} - @@ -192,4 +194,15 @@ actions, actions_confirmation) }} + + + {% endblock %} diff --git a/flask_admin/templates/bootstrap4/admin/layout.html b/flask_admin/templates/bootstrap4/admin/layout.html index a1cdc69850..f5a89e55f4 100644 --- a/flask_admin/templates/bootstrap4/admin/layout.html +++ b/flask_admin/templates/bootstrap4/admin/layout.html @@ -30,7 +30,7 @@
  • - + {% if item.class_name %} {% endif %} {{ menu_icon(item) }}{{ item.name }} diff --git a/flask_admin/templates/bootstrap4/admin/lib.html b/flask_admin/templates/bootstrap4/admin/lib.html index a99a78ca7e..608c85c8a1 100644 --- a/flask_admin/templates/bootstrap4/admin/lib.html +++ b/flask_admin/templates/bootstrap4/admin/lib.html @@ -27,7 +27,7 @@
    • {% else %}
  • - « + «
    • {% endif %} {% if page > 0 %} @@ -36,14 +36,14 @@ {% else %}
  • - < + <
    • {% endif %} {% for p in range(min, max) %} {% if page == p %}
  • - {{ p + 1 }} + {{ p + 1 }}
    • {% else %}
  • @@ -58,7 +58,7 @@
    • {% else %}
  • - > + >
    • {% endif %} {% if max < pages %} @@ -67,7 +67,7 @@ {% else %}
  • - » + »
    • {% endif %} diff --git a/flask_admin/templates/bootstrap4/admin/model/create.html b/flask_admin/templates/bootstrap4/admin/model/create.html index 1620f24bcf..af5532c590 100644 --- a/flask_admin/templates/bootstrap4/admin/model/create.html +++ b/flask_admin/templates/bootstrap4/admin/model/create.html @@ -14,7 +14,7 @@ {{ _gettext('List') }}
  • - {{ _gettext('Create') }} + {{ _gettext('Create') }}
    • {% endblock %} diff --git a/flask_admin/templates/bootstrap4/admin/model/details.html b/flask_admin/templates/bootstrap4/admin/model/details.html index 4e6408b27c..d80bf96976 100644 --- a/flask_admin/templates/bootstrap4/admin/model/details.html +++ b/flask_admin/templates/bootstrap4/admin/model/details.html @@ -18,7 +18,7 @@ {%- endif -%}
  • - {{ _gettext('Details') }} + {{ _gettext('Details') }}
    • {% endblock %} diff --git a/flask_admin/templates/bootstrap4/admin/model/edit.html b/flask_admin/templates/bootstrap4/admin/model/edit.html index c5631a8bb8..da65609ea4 100644 --- a/flask_admin/templates/bootstrap4/admin/model/edit.html +++ b/flask_admin/templates/bootstrap4/admin/model/edit.html @@ -19,7 +19,7 @@ {%- endif -%}
  • - {{ _gettext('Edit') }} + {{ _gettext('Edit') }}
    • {%- if admin_view.can_view_details -%}
  • diff --git a/flask_admin/templates/bootstrap4/admin/model/inline_list_base.html b/flask_admin/templates/bootstrap4/admin/model/inline_list_base.html index d8ed6ecd9b..e7650f7934 100644 --- a/flask_admin/templates/bootstrap4/admin/model/inline_list_base.html +++ b/flask_admin/templates/bootstrap4/admin/model/inline_list_base.html @@ -13,7 +13,9 @@ {% else %} - + + + {% endif %} @@ -32,7 +34,9 @@ {{ _gettext('New') }} {{ field.label.text }}
    - + + +
    @@ -40,6 +44,21 @@ {% endfilter %} - {{ _gettext('Add') }} {{ field.label.text }} + {{ _gettext('Add') }} {{ field.label.text }} + + {% endmacro %} diff --git a/flask_admin/templates/bootstrap4/admin/model/layout.html b/flask_admin/templates/bootstrap4/admin/model/layout.html index 0a828ead57..519ef84c1c 100644 --- a/flask_admin/templates/bootstrap4/admin/model/layout.html +++ b/flask_admin/templates/bootstrap4/admin/model/layout.html @@ -1,16 +1,29 @@ {% macro filter_options(btn_class='dropdown-toggle') %} - {{ _gettext('Add Filter') }} + {{ _gettext('Add Filter') }}
    {% for k in filter_groups %} - {{ k }} + {{ k }} {% endfor %}
    + + {% endmacro %} {% macro export_options(btn_class='dropdown-toggle') %} {% if admin_view.export_types|length > 1 %}
  • -
    {% for export_type in admin_view.export_types %} @@ -98,7 +111,7 @@ {% endmacro %} {% macro page_size_form(generator, page_size_options, btn_class='nav-link dropdown-toggle') %} - + {{ page_size }} {{ _gettext('items') }}
    diff --git a/flask_admin/templates/bootstrap4/admin/model/list.html b/flask_admin/templates/bootstrap4/admin/model/list.html index dcfb21907c..d0e6e902c6 100644 --- a/flask_admin/templates/bootstrap4/admin/model/list.html +++ b/flask_admin/templates/bootstrap4/admin/model/list.html @@ -14,7 +14,7 @@ {% block model_menu_bar %}
    • - {{ _gettext('List') }}{% if count %} ({{ count }}){% endif %} + {{ _gettext('List') }}{% if count %} ({{ count }}){% endif %}
      • {% if admin_view.can_create %} @@ -101,9 +101,9 @@ {{ name }} {% endif %} {% if admin_view.column_descriptions.get(c) %} - {% endif %} diff --git a/flask_admin/templates/bootstrap4/admin/model/row_actions.html b/flask_admin/templates/bootstrap4/admin/model/row_actions.html index 1fbfc5a562..1e2c073739 100644 --- a/flask_admin/templates/bootstrap4/admin/model/row_actions.html +++ b/flask_admin/templates/bootstrap4/admin/model/row_actions.html @@ -31,8 +31,24 @@ {% elif csrf_token is defined and csrf_token %} {% endif %} - + + + {% endmacro %} diff --git a/flask_admin/tests/csp/conftest.py b/flask_admin/tests/csp/conftest.py new file mode 100644 index 0000000000..7e9b62c83d --- /dev/null +++ b/flask_admin/tests/csp/conftest.py @@ -0,0 +1,33 @@ +import secrets +import typing as t + +import pytest +from flask import Flask +from flask_admin.base import Admin + + +@pytest.fixture +def babel(app: Flask) -> t.Generator[object | None, None, None]: + try: + from flask_babel import Babel + except ImportError: + yield None + return + + yield Babel(app) + + +@pytest.fixture +def nonce() -> str: + return secrets.token_urlsafe(32) + + +@pytest.fixture +def admin( + app: Flask, babel: t.Any | None, nonce: str +) -> t.Generator[Admin, t.Any, None]: + def csp_nonce_generator() -> str: + return nonce + + admin = Admin(app, csp_nonce_generator=csp_nonce_generator) + yield admin diff --git a/flask_admin/tests/csp/files/dir1/dum.txt b/flask_admin/tests/csp/files/dir1/dum.txt new file mode 100644 index 0000000000..1074252f23 --- /dev/null +++ b/flask_admin/tests/csp/files/dir1/dum.txt @@ -0,0 +1 @@ +this file is just a placeholder to avoid having empty directory! diff --git a/flask_admin/tests/csp/files/test.txt b/flask_admin/tests/csp/files/test.txt new file mode 100644 index 0000000000..b6e40ad397 --- /dev/null +++ b/flask_admin/tests/csp/files/test.txt @@ -0,0 +1 @@ +This is test file diff --git a/flask_admin/tests/csp/test_csp.py b/flask_admin/tests/csp/test_csp.py new file mode 100644 index 0000000000..71c2721a3d --- /dev/null +++ b/flask_admin/tests/csp/test_csp.py @@ -0,0 +1,170 @@ +import os.path as op +import typing as t + +import pytest +import sqlalchemy as sa +from bs4 import BeautifulSoup +from flask import Flask +from flask_admin._types import T_SQLALCHEMY_MODEL +from flask_admin.base import Admin +from flask_admin.contrib import fileadmin +from flask_admin.contrib.sqla.view import ModelView +from flask_admin.tests.conftest import skip_or_return_session_or_db +from flask_admin.tests.conftest import T_ANY_SQLA_PROVIDER +from flask_admin.tests.conftest import T_LITERAL_SESSION_OR_DB + + +def create_model_class(sqla_db_ext: T_ANY_SQLA_PROVIDER) -> T_SQLALCHEMY_MODEL: + class Model1(sqla_db_ext.Base): # type: ignore[misc, name-defined] + __tablename__ = "model1" + + id = sa.Column(sa.Integer, primary_key=True) + test1 = sa.Column(sa.String(20)) + test2 = sa.Column(sa.Unicode(20)) + bool_field = sa.Column(sa.Boolean) + + sqla_db_ext.create_all() + + return Model1 + + +def fill_db(sqla_db_ext: T_ANY_SQLA_PROVIDER, Model1: t.Any) -> None: + objs: list[dict[str, t.Any]] = [ + {"test1": "test1_val_1", "test2": "test2_val_1", "bool_field": True}, + {"test1": "test1_val_2", "test2": "test2_val_2", "bool_field": False}, + {"test1": "test1_val_3", "test2": "test2_val_3"}, + {"test1": "test1_val_4", "test2": "test2_val_4"}, + ] + + sqla_db_ext.db.session.add_all([Model1(**obj) for obj in objs]) + sqla_db_ext.db.session.commit() + + +class MyModelView(ModelView): + can_create = True + can_edit = True + can_delete = True + column_filters = ["bool_field"] + column_editable_list = ["test1", "bool_field"] + column_searchable_list = ["test1", "test2"] + can_view_details = True + can_export = True + page_size_options = (2, 5, 10) + + +class MyFileView(fileadmin.FileAdmin): + can_delete = True + can_upload = True + can_delete_dirs = True + can_rename = True + editable_extensions = ("txt",) + + +class TestCSPOnAllPages: + def create_modelview( + self, app: Flask, admin: Admin, db_session: t.Any, Model1: t.Any + ) -> MyModelView: + with app.app_context(): + v = MyModelView(Model1, db_session) + admin.add_view(v) + + return v + + def create_modelview_with_modal( + self, app: Flask, admin: Admin, db_session: t.Any, Model1: t.Any + ) -> MyModelView: + class ModalModelView(MyModelView): + create_modal = True + edit_modal = True + details_modal = True + + with app.app_context(): + vi = ModalModelView(Model1, db_session, endpoint="modal") + admin.add_view(vi) + + return vi + + _test_files_root = op.join(op.dirname(__file__), "files") + + def create_fileview(self, admin: Admin) -> MyFileView: + view = MyFileView(self._test_files_root, name="Files", endpoint="fa") + admin.add_view(view) + + return view + + def create_fileview_with_modal(self, admin: Admin) -> MyFileView: + class ModalFileView(MyFileView): + edit_modal = True + rename_modal = True + mkdir_modal = True + upload_modal = True + + v = ModalFileView(self._test_files_root, name="ModalFiles", endpoint="modalfa") + + admin.add_view(v) + return v + + @pytest.mark.parametrize( + "endpoint, url", + [ + ("", ""), # index view + ("model1", "?flt1_0=1"), + ("model1", "new/"), + ("model1", "edit/?id=1"), + ("model1", "details/?id=1"), + ("modal", "?flt1_0=1"), + ("modal", "new/"), + ("modal", "edit/?id=1"), + ("modal", "details/?id=1"), + ("fa", ""), + ("fa", "rename/?path=test.txt"), + ("fa", "rename/?path=dir1"), + ("fa", "edit/?path=test.txt"), + ("modalfa", ""), + ("modalfa", "rename/?path=test.txt"), + ("modalfa", "rename/?path=dir1"), + ("modalfa", "edit/?path=test.txt"), + ], + ) + def test_csp( + self, + app: Flask, + admin: Admin, + sqla_db_ext: T_ANY_SQLA_PROVIDER, + session_or_db: T_LITERAL_SESSION_OR_DB, + nonce: str, + endpoint: str, + url: str, + ) -> None: + Model1 = create_model_class(sqla_db_ext) + + param = skip_or_return_session_or_db(sqla_db_ext, session_or_db) + self.create_modelview(app, admin, param, Model1) + self.create_modelview_with_modal(app, admin, param, Model1) + self.create_fileview(admin) + self.create_fileview_with_modal(admin) + + with app.app_context(): + fill_db(sqla_db_ext, Model1) + client = app.test_client() + + # check that we can retrieve a list view + rv = client.get(f"/admin/{endpoint}/{url}", follow_redirects=True) + assert rv.status_code == 200 + + soup = BeautifulSoup(rv.data, "html.parser") + + scripts = soup.select("script") + for tag in scripts: + assert tag.attrs["nonce"] == nonce + + styles = soup.select("style") + for tag in styles: + assert tag.attrs["nonce"] == nonce + + # FIXME: This test is currently a no-op since the RedisView is not being added + # to the admin instance. We should add it and then test that the nonce is + # injected into the view's templates. + @pytest.mark.skip(reason="RedisView is not added to the admin instance.") + def test_csp_on_rediscli(self, app: Flask, admin: Admin, nonce: str) -> None: + pass diff --git a/flask_admin/translations/en/LC_MESSAGES/admin.mo b/flask_admin/translations/en/LC_MESSAGES/admin.mo index 376de3f9f7..e6303a386a 100644 Binary files a/flask_admin/translations/en/LC_MESSAGES/admin.mo and b/flask_admin/translations/en/LC_MESSAGES/admin.mo differ