Fix #78 Add CSP Header

+ update morris and raphael graph libraries
+ some changes in "myfiles" table

lib/Lutim.pm

@@ -105,8 +105,8 @@ sub startup {
     # Static assets gzipping
     $self->plugin('GzipStatic');
 
-    # Cache static files
-    $self->plugin('StaticCache' => { even_in_dev => 1 });
+    # Headers
+    $self->plugin('Lutim::Plugin::Headers');
 
     # Helpers
     $self->plugin('Lutim::Plugin::Helpers');

lib/Lutim/Command/cron/stats.pm

@@ -151,7 +151,10 @@ sub run {
 %     l('1 year'),
 %     l('Total')
 % );
-<script>
+$dom2
+EOF
+
+    my $js = <<EOF;
 var enabled_donut = {
   element: 'raw-enabled-holder',
   data: [
@@ -186,13 +189,12 @@ var disabled_donut = {
       '#455ac3',
   ]
 };
-</script>
-$dom2
 EOF
 
     Mojo::File->new('themes/'.$config->{theme}.'/templates/stats.json.ep')->spurt(encode_json($stats));
     Mojo::File->new('themes/'.$config->{theme}.'/templates/data.html.ep')->spurt($dom);
     Mojo::File->new('themes/'.$config->{theme}.'/templates/raw.html.ep')->spurt(encode('UTF-8', $dom2));
+    Mojo::File->new('themes/'.$config->{theme}.'/templates/partial/raw.js.ep')->spurt(encode('UTF-8', $js));
 }
 
 =encoding utf8

lib/Lutim/Plugin/Headers.pm

@@ -0,0 +1,39 @@
+package Lutim::Plugin::Headers;
+use Mojo::Base 'Mojolicious::Plugin';
+
+sub register {
+    my ($self, $app) = @_;
+
+    # Assets Cache headers
+    $app->plugin('StaticCache' => { even_in_dev => 1 });
+
+    # Add CSP Header
+    if (!defined($app->config('csp')) || (defined($app->config('csp')) && $app->config('csp') ne '')) {
+        my $directives = {
+            'default-src'     => "'none'",
+            'script-src'      => "'self' 'unsafe-eval'",
+            'style-src'       => "'self' 'unsafe-inline'",
+            'connect-src'     => "'self'",
+            'img-src'         => "'self' data:",
+            'font-src'        => "'self'",
+            'form-action'     => "'self'",
+            'base-uri'        => "'self'",
+        };
+
+        my $frame_ancestors = '';
+        #$frame_ancestors = "'none'" if $app->config('x_frame_options') eq 'DENY';
+        #$frame_ancestors = "'self'" if $app->config('x_frame_options') eq 'SAMEORIGIN';
+        #if ($app->config('x_frame_options') =~ m#^ALLOW-FROM#) {
+        #    $frame_ancestors = $app->config('x_frame_options');
+        #    $frame_ancestors =~ s#ALLOW-FROM +##;
+        #}
+        $directives->{'frame-ancestors'} = $frame_ancestors if $frame_ancestors;
+
+        $app->plugin('CSPHeader',
+            csp        => $app->config('csp'),
+            directives => $directives
+        );
+    }
+}
+
+1;

lib/Mounter.pm

@@ -69,8 +69,8 @@ sub startup {
     # Static assets gzipping
     $self->plugin('GzipStatic');
 
-    # Cache static files
-    $self->plugin('StaticCache' => { even_in_dev => 1 });
+    # Headers
+    $self->plugin('Lutim::Plugin::Headers');
 
     # Helpers
     $self->plugin('Lutim::Plugin::Helpers');