mirror of
https://github.com/MagicMirrorOrg/MagicMirror.git
synced 2026-03-12 17:51:41 +08:00
9dd964e004
## Loading `config.js` ### Previously Loaded on server-side in `app.js` and in the browser by including `config.js` in `index.html`. The web server has an endpoint `/config` providing the content of server loaded `config.js`. ### Now Loaded only on server-side in `app.js`. The browser loads the content using the web server endpoint `/config`. So the server has control what to provide to the clients. Loading the `config.js` was moved to `Utils.js` so that `check_config.js` can use the same functions. ## Using environment variables in `config.js` ### Previously Environment variables were not allowed in `config.js`. The workaround was to create a `config.js.template` with curly braced bash variables allowed. While starting the app the `config.js.template` was converted via `envsub` into a `config.js`. ### Now Curly braced bash variables are allowed in `config.js`. Because only the server loads `config.js` he can substitute the variables while loading. ## Secrets in MagicMirror² To be honest, this is a mess. ### Previously All content defined in the `config` directory was reachable from the browser. Everyone with access to the site could see all stuff defined in the configuration e.g. using the url http://ip:8080/config. This included api keys and other secrets. So sharing a MagicMirror² url to others or running MagicMirror² without authentication as public website was not possible. ### Now With this PR we add (beta) functionality to protect sensitive data. This is only possible for modules running with a `node_helper`. For modules running in the browser only (e.g. default `weather` module), there is no way to hide data (per construction). This does not mean, that every module with `node_helper` is safe, e.g. the default `calendar` module is not safe because it uses the calendar url's as sort of id and sends them to the client. For adding more security you have to set `hideConfigSecrets: true` in `config.js`. With this: - `config/config.env` is not deliverd to the browser - the contents of environment variables beginning with `SECRET_` are not published to the clients This is a first step to protect sensitive data and you can at least protect some secrets.
63 lines
3.1 KiB
HTML
63 lines
3.1 KiB
HTML
<!doctype html>
|
|
<html>
|
|
<head>
|
|
<title>MagicMirror²</title>
|
|
<meta name="google" content="notranslate" />
|
|
<meta http-equiv="Content-type" content="text/html; charset=utf-8" />
|
|
|
|
<meta name="apple-mobile-web-app-capable" content="yes" />
|
|
<meta name="apple-mobile-web-app-status-bar-style" content="black" />
|
|
<meta name="format-detection" content="telephone=no" />
|
|
<meta name="mobile-web-app-capable" content="yes" />
|
|
|
|
<link rel="icon" href="favicon.svg" />
|
|
<link rel="stylesheet" type="text/css" href="css/main.css" />
|
|
<link rel="stylesheet" type="text/css" href="css/roboto.css" />
|
|
<link rel="stylesheet" type="text/css" href="node_modules/animate.css/animate.min.css" />
|
|
<!-- custom.css is loaded by the loader.js to make sure it's loaded after the module css files. -->
|
|
|
|
<script type="text/javascript">
|
|
window.mmVersion = "#VERSION#";
|
|
window.mmTestMode = "#TESTMODE#";
|
|
</script>
|
|
</head>
|
|
<body>
|
|
<div class="region fullscreen below"><div class="container"></div></div>
|
|
<div class="region top bar">
|
|
<div class="container"></div>
|
|
<div class="region top left"><div class="container"></div></div>
|
|
<div class="region top center"><div class="container"></div></div>
|
|
<div class="region top right"><div class="container"></div></div>
|
|
</div>
|
|
<div class="region upper third"><div class="container"></div></div>
|
|
<div class="region middle center"><div class="container"></div></div>
|
|
<div class="region lower third">
|
|
<div class="container"><br /></div>
|
|
</div>
|
|
<div class="region bottom bar">
|
|
<div class="container"></div>
|
|
<div class="region bottom left"><div class="container"></div></div>
|
|
<div class="region bottom center"><div class="container"></div></div>
|
|
<div class="region bottom right"><div class="container"></div></div>
|
|
</div>
|
|
<div class="region fullscreen above"><div class="container"></div></div>
|
|
<script type="text/javascript" src="socket.io/socket.io.js"></script>
|
|
<script type="text/javascript" src="node_modules/nunjucks/browser/nunjucks.min.js"></script>
|
|
<script type="text/javascript" src="js/defaults.js"></script>
|
|
<script type="text/javascript" src="js/vendor.js"></script>
|
|
<script type="text/javascript" src="defaultmodules/defaultmodules.js"></script>
|
|
<script type="text/javascript" src="defaultmodules/utils.js"></script>
|
|
<script type="text/javascript" src="js/logger.js"></script>
|
|
<script type="text/javascript" src="translations/translations.js"></script>
|
|
<script type="text/javascript" src="js/translator.js"></script>
|
|
<script type="text/javascript" src="js/class.js"></script>
|
|
<script type="text/javascript" src="config/basepath.js"></script>
|
|
<script type="text/javascript" src="js/module.js"></script>
|
|
<script type="text/javascript" src="js/loader.js"></script>
|
|
<script type="text/javascript" src="js/socketclient.js"></script>
|
|
<script type="text/javascript" src="js/animateCSS.js"></script>
|
|
<script type="text/javascript" src="js/positions.js"></script>
|
|
<script type="text/javascript" src="js/main.js"></script>
|
|
</body>
|
|
</html>
|