From dd3f2d60b6e99f83c1fb0f80026e608719588590 Mon Sep 17 00:00:00 2001 From: Micah Lee Date: Thu, 14 Feb 2019 09:31:39 -0800 Subject: Update the noscript upload instructions on the receive mode upload page, and add separate page for instructions to disable NoScript XSS setting --- onionshare/web/web.py | 8 +++++++ share/static/css/style.css | 7 ++++++- share/templates/receive.html | 17 ++++++++------- share/templates/receive_noscript_xss.html | 35 +++++++++++++++++++++++++++++++ 4 files changed, 59 insertions(+), 8 deletions(-) create mode 100644 share/templates/receive_noscript_xss.html diff --git a/onionshare/web/web.py b/onionshare/web/web.py index 183c512c..010702be 100644 --- a/onionshare/web/web.py +++ b/onionshare/web/web.py @@ -132,6 +132,14 @@ class Web(object): self.force_shutdown() return "" + @self.app.route("/noscript-xss-instructions") + def noscript_xss_instructions(): + """ + Display instructions for disabling Tor Browser's NoScript XSS setting + """ + r = make_response(render_template('receive_noscript_xss.html')) + return self.add_security_headers(r) + def error404(self): self.add_request(Web.REQUEST_OTHER, request.path) if request.path != '/favicon.ico': diff --git a/share/static/css/style.css b/share/static/css/style.css index 5cf5245e..daaa9ce4 100644 --- a/share/static/css/style.css +++ b/share/static/css/style.css @@ -199,10 +199,15 @@ div#noscript { color: #e55454; padding: 1em; line-height: 150%; - max-width: 700px; + max-width: 900px; margin: 100px 2em 0 2em; } div#noscript a, div#noscript a:visited { color: #e27f7f; } + +.disable-noscript-xss-wrapper { + max-width: 900px; + margin: 0 auto; +} diff --git a/share/templates/receive.html b/share/templates/receive.html index 02c65cc2..9f8201c7 100644 --- a/share/templates/receive.html +++ b/share/templates/receive.html @@ -25,7 +25,7 @@ {% if messages %} {% endif %} @@ -34,15 +34,18 @@ + is set to Safest, not Safer. + + For more information about the upload issue: + https://github.com/micahflee/onionshare/issues/899 + -->

- Warning: Due to a bug in Tor Browser and Firefox, if you - want to upload a file bigger than 50mb, you must set the Tor Browser + Warning: Due to a bug in Tor Browser and Firefox, uploads + sometimes never finish. To upload reliably, either set your Tor Browser security slider - to Standard. Otherwise your upload will never finish.

- -

If you plan on only uploading small files, your current settings are fine.

+ to Standard or + turn off your Tor Browser's NoScript XSS setting.

diff --git a/share/templates/receive_noscript_xss.html b/share/templates/receive_noscript_xss.html new file mode 100644 index 00000000..bf846b03 --- /dev/null +++ b/share/templates/receive_noscript_xss.html @@ -0,0 +1,35 @@ + + + + OnionShare + + + + + +
+ +

OnionShare

+
+ +
+

Disable your Tor Browser's NoScript XSS setting

+ +

If your security slider is set to Safest, JavaScript is disabled so XSS vulnerabilities won't affect you, + which makes it safe to disable NoScript's XSS protections.

+ +

Here is how to disable this setting:

+ +
    +
  1. Click the menu icon in the top-right of Tor Browser and open "Add-ons"
    2. +
  2. Next to the NoScript add-on, click the "Preferences" button
    3. +
  3. Switch to the "Advanced" tab
    4. +
  4. Uncheck "Sanitize cross-site suspicious requests"
    5. +
+ +

If you'd like to learn technical details about this issue, check + this issue + on GitHub.

+
+ + -- cgit v1.2.3-54-g00ecf