nextcloud/core/templates/layout.guest.php

<!DOCTYPE html>
<html class="ng-csp" data-placeholder-focus="false" lang="<?php p($_['language']); ?>" >
	<head data-requesttoken="<?php p($_['requesttoken']); ?>">
		<meta charset="utf-8">
		<title>
		<?php p($theme->getTitle()); ?>
		</title>
		<meta http-equiv="X-UA-Compatible" content="IE=edge">
		<meta name="referrer" content="never">
		<meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0">
		<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">
		<meta name="theme-color" content="<?php p($theme->getMailHeaderColor()); ?>">
		<link rel="icon" href="<?php print_unescaped(image_path('', 'favicon.ico')); /* IE11+ supports png */ ?>">
		<link rel="apple-touch-icon-precomposed" href="<?php print_unescaped(image_path('', 'favicon-touch.png')); ?>">
		<link rel="mask-icon" sizes="any" href="<?php print_unescaped(image_path('', 'favicon-mask.svg')); ?>" color="#1d2d44">
		<?php foreach($_['cssfiles'] as $cssfile): ?>
			<link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>">
		<?php endforeach; ?>
		<?php foreach($_['printcssfiles'] as $cssfile): ?>
			<link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>" media="print">
		<?php endforeach; ?>
		<?php foreach($_['jsfiles'] as $jsfile): ?>
			<script nonce="<?php p(base64_encode($_['requesttoken'])) ?>" src="<?php print_unescaped($jsfile); ?>"></script>
		<?php endforeach; ?>
		<?php print_unescaped($_['headers']); ?>
	</head>
	<body id="<?php p($_['bodyid']);?>">
		<?php include('layout.noscript.warning.php'); ?>
		<div class="wrapper">
			<div class="v-align">
				<?php if ($_['bodyid'] === 'body-login' ): ?>
					<header role="banner">
						<div id="header">
							<div class="logo">
								<h1 class="hidden-visually">
									<?php p($theme->getName()); ?>
								</h1>
							</div>
							<div id="logo-claim" style="display:none;"><?php p($theme->getLogoClaim()); ?></div>
						</div>
					</header>
				<?php endif; ?>
				<?php print_unescaped($_['content']); ?>
				<div class="push"></div><!-- for sticky footer -->
			</div>
		</div>
		<footer role="contentinfo">
			<p class="info">
				<?php print_unescaped($theme->getLongFooter()); ?>
			</p>
		</footer>
	</body>
</html>
this is now HTML5 2011-04-17 01:29:54 +04:00			`<!DOCTYPE html>`
remove ie8+9 support 2016-06-16 09:28:43 +03:00			`<html class="ng-csp" data-placeholder-focus="false" lang="<?php p($_['language']); ?>" >`
Add requesttoken to guest view Should fix #3321 2013-05-13 16:23:56 +04:00			`<head data-requesttoken="<?php p($_['requesttoken']); ?>">`
adressing #14979 meta charset declaration should be first in head 2015-03-18 01:36:05 +03:00			`<meta charset="utf-8">`
mage page title aware of ownCloud edition 2013-06-12 16:33:24 +04:00			`<title>`
initialize OC_Defaults in template constructorX 2013-07-24 13:51:21 +04:00			`<?php p($theme->getTitle()); ?>`
mage page title aware of ownCloud edition 2013-06-12 16:33:24 +04:00			`</title>`
addressing #14983 obsolete Google Chrome Frame 2015-03-18 04:11:47 +03:00			`<meta http-equiv="X-UA-Compatible" content="IE=edge">`
Prevent referer from being sent Nice hardening for enhanced privacy. Especially useful when using embedded viewers such as files_pdfviewer. 2015-09-09 19:07:43 +03:00			`<meta name="referrer" content="never">`
restrict zooming on mobile devices for the publicly accessible, optimized pages 2014-01-17 17:41:05 +04:00			`<meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0">`
templates: use p() for getiTunesAppId 2014-08-28 12:12:59 +04:00			`<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">`
add theme-color for better Android browser integration 2015-07-29 19:16:01 +03:00			`<meta name="theme-color" content="<?php p($theme->getMailHeaderColor()); ?>">`
Stupid clients only literally understand rel="icon" rel="shortcut icon" hasn’t been relevant in years, isn’t in any standards, and causes problems for simple pattern matching clients. https://www.w3.org/TR/html/links.html#linkTypes 2016-03-08 23:09:34 +03:00			`<link rel="icon" href="<?php print_unescaped(image_path('', 'favicon.ico')); /* IE11+ supports png */ ?>">`
addressing #14982 self-closing tags ending slash doesn't have a purpose & should be removed 2015-03-18 01:57:23 +03:00			`<link rel="apple-touch-icon-precomposed" href="<?php print_unescaped(image_path('', 'favicon-touch.png')); ?>">`
Added Safari tabbed pin icon Added the necessary code and a black and inverted version of the favicon/ touch icon in svg format 2015-11-02 21:23:35 +03:00			`<link rel="mask-icon" sizes="any" href="<?php print_unescaped(image_path('', 'favicon-mask.svg')); ?>" color="#1d2d44">`
some header fixes 2011-08-20 00:53:07 +04:00			`<?php foreach($_['cssfiles'] as $cssfile): ?>`
support print stylesheets 2015-06-10 13:16:45 +03:00			`<link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>">`
			`<?php endforeach; ?>`
			`<?php foreach($_['printcssfiles'] as $cssfile): ?>`
			`<link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>" media="print">`
Fixed PHP syntax in template files. * Full PHP tags * Alternative syntax for control structures * Semi-colon at the end of instructions 2011-03-09 23:57:00 +03:00			`<?php endforeach; ?>`
some header fixes 2011-08-20 00:53:07 +04:00			`<?php foreach($_['jsfiles'] as $jsfile): ?>`
Add support for CSP nonces CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce. At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.) IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO. Implementing this offers the following advantages: 1. Security: As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist 2. Performance: We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file. If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/ Signed-off-by: Lukas Reschke <lukas@statuscode.ch> 2016-10-24 12:00:00 +03:00			`<script nonce="<?php p(base64_encode($_['requesttoken'])) ?>" src="<?php print_unescaped($jsfile); ?>"></script>`
Fixed PHP syntax in template files. * Full PHP tags * Alternative syntax for control structures * Semi-colon at the end of instructions 2011-03-09 23:57:00 +03:00			`<?php endforeach; ?>`
Fix the "addHeader($tag, $attributes, $text)" methods to not ignore the $text parameter Also support closing tags with no text content given Conflicts: lib/private/template.php 2014-10-28 13:15:58 +03:00			`<?php print_unescaped($_['headers']); ?>`
Getting rid of Smarty, using our own template system 2011-03-02 13:56:48 +03:00			`</head>`
Step one, open guest layout for different styles. Conflicts: core/templates/layout.guest.php Step one, open guest layout for different styles. 2014-09-11 13:39:50 +04:00			`<body id="<?php p($_['bodyid']);?>">`
Deduplicate template code and do not translate the links 2015-02-09 18:01:52 +03:00			`<?php include('layout.noscript.warning.php'); ?>`
fixing #15023, getting comments out of HTML output 2015-03-21 09:10:46 +03:00			`<div class="wrapper">`
			`<div class="v-align">`
Step one, open guest layout for different styles. Conflicts: core/templates/layout.guest.php Step one, open guest layout for different styles. 2014-09-11 13:39:50 +04:00			`<?php if ($_['bodyid'] === 'body-login' ): ?>`
fixing #15011 by adding ARIA roles where distinct 2015-03-18 21:29:15 +03:00			`<header role="banner">`
Step one, open guest layout for different styles. Conflicts: core/templates/layout.guest.php Step one, open guest layout for different styles. 2014-09-11 13:39:50 +04:00			`<div id="header">`
remove svg classes 2016-06-23 14:39:28 +03:00			`<div class="logo">`
fix accessibility of logos 2014-12-18 12:50:05 +03:00			`<h1 class="hidden-visually">`
			`<?php p($theme->getName()); ?>`
			`</h1>`
introduce h1, use either ownCloud name or current app name 2014-11-06 15:26:38 +03:00			`</div>`
Step one, open guest layout for different styles. Conflicts: core/templates/layout.guest.php Step one, open guest layout for different styles. 2014-09-11 13:39:50 +04:00			`<div id="logo-claim" style="display:none;"><?php p($theme->getLogoClaim()); ?></div>`
			`</div>`
			`</header>`
			`<?php endif; ?>`
Vertically align public layout to better fit small mobile screens 2014-04-10 02:33:55 +04:00			`<?php print_unescaped($_['content']); ?>`
Step one, open guest layout for different styles. Conflicts: core/templates/layout.guest.php Step one, open guest layout for different styles. 2014-09-11 13:39:50 +04:00			`<div class="push"></div><!-- for sticky footer -->`
Vertically align public layout to better fit small mobile screens 2014-04-10 02:33:55 +04:00			`</div>`
sticky footer 2013-07-22 15:16:01 +04:00			`</div>`
fixing #15011 by adding ARIA roles where distinct 2015-03-18 21:29:15 +03:00			`<footer role="contentinfo">`
make footer aware of ownCloud editions 2013-06-12 16:49:30 +04:00			`<p class="info">`
initialize OC_Defaults in template constructorX 2013-07-24 13:51:21 +04:00			`<?php print_unescaped($theme->getLongFooter()); ?>`
input field adjustments for new full-color background on log in 2013-07-22 14:40:28 +04:00			`</p>`
			`</footer>`
Getting rid of Smarty, using our own template system 2011-03-02 13:56:48 +03:00			`</body>`
			`</html>`