OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

2026-09-03 18:49:20 +08:00
commit d647428529
3501 changed files with 1988906 additions and 0 deletions
--- a/app/Core/Middleware/InitialHeaders.php
+++ b/app/Core/Middleware/InitialHeaders.php
@@ -0,0 +1,78 @@
+<?php
+
+namespace Leantime\Core\Middleware;
+
+use Closure;
+use Leantime\Core\Events\DispatchesEvents;
+use Leantime\Core\Http\IncomingRequest;
+use Symfony\Component\HttpFoundation\Response;
+
+class InitialHeaders
+{
+    use DispatchesEvents;
+
+    /**
+     * Set up the initial headers
+     *
+     * @param  \Closure(IncomingRequest): Response  $next
+     *
+     * @throws \Illuminate\Contracts\Container\BindingResolutionException
+     **/
+    public function handle($request, Closure $next): Response
+    {
+
+        $response = $next($request);
+
+        // Content Security Policy
+        $cspParts = [
+            "default-src 'self' 'unsafe-inline'",
+            "base-uri 'self';",
+            "script-src 'self' 'unsafe-inline' unpkg.com",
+            "font-src 'self'  data: unpkg.com",
+            "img-src * 'self' *.leantime.io *.amazonaws.com data: blob: marketplace.localhost",
+            // Allow all embed providers supported by the TipTap embed extension.
+            // Each entry corresponds to one or more embed types in embed.js.
+            "frame-src 'self'"
+                .' *.google.com'                          // googleDocs, googleSheets, googleSlides, googleForms
+                .' *.microsoft.com *.live.com *.sharepoint.com *.officeapps.live.com' // oneDrive, office365
+                .' *.figma.com'                           // figma
+                .' *.miro.com'                            // miro
+                .' *.youtube.com *.youtube-nocookie.com'  // youtube
+                .' player.vimeo.com *.vimeo.com'          // vimeo
+                .' *.loom.com'                            // loom
+                .' *.airtable.com'                        // airtable
+                .' *.typeform.com form.typeform.com'      // typeform
+                .' calendly.com'                          // calendly
+                .' codepen.io'                            // codepen
+                .' *.codesandbox.io',                     // codesandbox
+            "frame-ancestors 'self' *.google.com *.microsoft.com *.live.com",
+        ];
+        $cspParts = self::dispatchFilter('cspParts', $cspParts);
+        $csp = implode(';', $cspParts);
+
+        foreach (
+            self::dispatchFilter('headers', [
+                'X-Frame-Options' => 'SAMEORIGIN',
+                'X-XSS-Protection' => '1; mode=block',
+                'X-Content-Type-Options' => 'nosniff',
+                'Referrer-Policy' => 'same-origin',
+                'Access-Control-Allow-Origin' => BASE_URL,
+                'Cache-Control' => 'no-cache, no-store, must-revalidate',
+                'Pragma' => 'no-cache',
+                'Content-Security-Policy' => $csp,
+            ]) as $key => $value
+        ) {
+            if ($response->headers->has($key)) {
+                continue;
+            }
+
+            $response->headers->set($key, $value);
+        }
+
+        if ($request->isSecure() || env('LEAN_HSTS_ENABLED', false)) {
+            $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+        }
+
+        return $response;
+    }
+}