From 419d411b1b4913a0e77dfd9633b97659b80a6e47 Mon Sep 17 00:00:00 2001
From: zzz <zzz@mail.i2p>
Date: Sun, 4 Mar 2018 13:31:35 +0000
Subject: [PATCH] i2ptunnel: Fix multipart config for /register Fix CSP for
 /register

---
 apps/i2ptunnel/java/build.xml   | 12 ++++++++++++
 apps/i2ptunnel/jsp/register.jsp |  3 +--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/apps/i2ptunnel/java/build.xml b/apps/i2ptunnel/java/build.xml
index 2a628f5f3..6f0a82d0f 100644
--- a/apps/i2ptunnel/java/build.xml
+++ b/apps/i2ptunnel/java/build.xml
@@ -344,6 +344,18 @@
         <replace file="../jsp/web-out.xml">
             <replacefilter token="&lt;!-- precompiled servlets --&gt;" value="${jspc.web.fragment}" />
         </replace>
+        <!-- Add multipart config to servlets that need them -->
+        <property name="__match1" value="&lt;servlet-class&gt;net.i2p.i2ptunnel.jsp." />
+        <property name="__match2" value="_jsp&lt;/servlet-class&gt;" />
+        <property name="__class1" value="${__match1}register${__match2}" />
+        <property name="__multipart" value="&#10;
+       &lt;multipart-config&gt;&#10;
+           &lt;max-file-size&gt;131072&lt;/max-file-size&gt;&#10;
+           &lt;max-request-size&gt;131072&lt;/max-request-size&gt;&#10;
+       &lt;/multipart-config&gt;" />
+        <replace file="../jsp/web-out.xml">
+            <replacefilter token="${__class1}" value="${__class1}${__multipart}" />
+        </replace>
     </target>
 
     <uptodate property="precompilejsp.uptodate" targetfile="../jsp/web-out.xml">
diff --git a/apps/i2ptunnel/jsp/register.jsp b/apps/i2ptunnel/jsp/register.jsp
index 4f928464c..0243d952b 100644
--- a/apps/i2ptunnel/jsp/register.jsp
+++ b/apps/i2ptunnel/jsp/register.jsp
@@ -2,8 +2,7 @@
     // NOTE: Do the header carefully so there is no whitespace before the <?xml... line
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
-    // edit pages need script for the delete button 'are you sure'
-    response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'");
+    response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
     response.setHeader("Referrer-Policy", "no-referrer");