fix(CSP): more Amazon domains

This reverts commit 2917955ef0.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "habitica",
-  "version": "5.42.1",
+  "version": "5.42.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "habitica",
-      "version": "5.42.1",
+      "version": "5.42.2",
       "hasInstallScript": true,
       "dependencies": {
         "@babel/core": "^7.22.10",
@@ -45,7 +45,7 @@
         "gulp-imagemin": "^7.1.0",
         "gulp.spritesmith": "^6.13.0",
         "habitica-markdown": "^3.0.0",
-        "helmet": "^4.6.0",
+        "helmet": "^8.1.0",
         "in-app-purchase": "^1.11.3",
         "js2xmlparser": "^5.0.0",
         "jsonwebtoken": "^9.0.2",
@@ -12450,11 +12450,11 @@
       }
     },
     "node_modules/helmet": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/helmet/-/helmet-4.6.0.tgz",
-      "integrity": "sha512-HVqALKZlR95ROkrnesdhbbZJFi/rIVSoNq6f3jA/9u6MIbTsPh3xZwihjeI5+DO/2sOV6HMHooXcEOuwskHpTg==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.1.0.tgz",
+      "integrity": "sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==",
       "engines": {
-        "node": ">=10.0.0"
+        "node": ">=18.0.0"
       }
     },
     "node_modules/hex2dec": {

package.json

@@ -1,7 +1,7 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "5.42.1",
+  "version": "5.42.2",
   "main": "./website/server/index.js",
   "dependencies": {
     "@babel/core": "^7.22.10",
@@ -40,7 +40,7 @@
     "gulp-imagemin": "^7.1.0",
     "gulp.spritesmith": "^6.13.0",
     "habitica-markdown": "^3.0.0",
-    "helmet": "^4.6.0",
+    "helmet": "^8.1.0",
     "in-app-purchase": "^1.11.3",
     "js2xmlparser": "^5.0.0",
     "jsonwebtoken": "^9.0.2",

website/client/src/components/group-plans/billing.vue

@@ -52,7 +52,7 @@
       <div
         v-if="!group.purchased.plan.dateTerminated
           && group.purchased.plan.paymentMethod === 'Stripe'"
-        class="btn btn-primary"
+        class="btn btn-primary mb-3"
         @click="redirectToStripeEdit({groupId: group.id})"
       >
         {{ $t('subUpdateCard') }}

website/client/src/components/settings/subscription.vue

@@ -189,6 +189,7 @@
             >
             </p>
             <div
+              v-if="paymentMethodLogo.icon"
               class="svg svg-icon mb-4"
               :class="paymentMethodLogo.class"
               v-html="paymentMethodLogo.icon"
@@ -205,6 +206,13 @@
                 <div>{{ $t('subUpdateCard') }}</div>
               </button>
             </div>
+            <div
+              v-once
+              v-if="!hasGroupPlan"
+              class="small text-center mb-4"
+            >
+              {{ $t('subscriptionBillingFYIShort') }}
+            </div>
             <div
               v-if="purchasedPlanExtraMonthsDetails.months > 0"
               class="extra-months green-10 py-2 px-3 mb-4"
@@ -409,6 +417,7 @@
       <div class="d-flex flex-column align-items-center mt-3">
         <div
           v-once
+          v-if="!hasSubscription"
           class="small gray-100 w-50 text-center mb-5"
         >
           {{ $t('subscriptionBillingFYI') }}

website/common/locales/en/subscriber.json

@@ -273,5 +273,6 @@
     "earn2GemsGift": "They'll earn <strong>+2 Gems</strong> every month they're subscribed",
     "maxGemCapGift": "They'll have the max <strong>Gem Cap</strong>",
     "subscribeAgainContinueHourglasses": "Subscribe again to continue receiving Mystic Hourglasses",
-    "subscriptionBillingFYI": "Subscriptions automatically renew unless you cancel at least 24 hours before the end of the current period. You can manage your subscription from the Subscription tab in settings. Your account will be charged within 24 hours of your renewal date, at the same price you initially paid."
+    "subscriptionBillingFYI": "Subscriptions automatically renew unless you cancel at least 24 hours before the end of the current period. You can manage your subscription from the Subscription tab in settings. Your account will be charged within 24 hours of your renewal date, at the same price you initially paid.",
+    "subscriptionBillingFYIShort": "Subscriptions automatically renew unless you cancel at least 24 hours before the end of the current period. Your account will be charged within 24 hours of your renewal date, at the same price you initially paid."
 }

website/common/script/content/constants/events.js

@@ -109,8 +109,8 @@ export const REPEATING_EVENTS = {
     foodSeason: 'Pie',
   },
   giftOneGetOne: {
-    start: new Date('1970-12-18T04:00-05:00'),
-    end: new Date('1970-01-05T23:59-05:00'),
+    start: new Date('1970-12-16T04:00-05:00'),
+    end: new Date('1970-01-09T23:59-05:00'),
     promo: 'g1g1',
   },
 };

website/server/middlewares/index.js

@@ -66,7 +66,35 @@ export default function attachMiddlewares (app, server) {
   // See https://helmetjs.github.io/ for the list of headers enabled by default
   app.use(helmet({
     // New middlewares added by default in Helmet 4 are disabled
-    contentSecurityPolicy: false, // @TODO implement
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: [
+          '*.habitica.com',
+          '*.amazon.com',
+          '*.amazonaws.com',
+          '*.loggly.com',
+          '*.payments-amazon.com',
+          '*.stripe.com',
+          '*.stripe.network',
+        ],
+        imgSrc: [
+          '*',
+          'data:',
+        ],
+        scriptSrc: [
+          '\'unsafe-eval\'',
+          '\'unsafe-inline\'',
+          '*.habitica.com',
+          '*.amazon.com',
+          '*.amazonaws.com',
+          '*.loggly.com',
+          '*.payments-amazon.com',
+          '*.stripe.com',
+          '*.stripe.network',
+        ],
+        upgradeInsecureRequests: IS_PROD ? [] : null,
+      },
+    },
     expectCt: false,
     permittedCrossDomainPolicies: false,
     referrerPolicy: false,