bump selkies, block downloads properly, fix icon copies, make sure downloads are not rendered in browser

Author: thelamer

Dockerfile

@@ -16,7 +16,7 @@ RUN \
     https://github.com/selkies-project/selkies.git \
     /src && \
   cd /src && \
-  git checkout -f 7cf9ad486b370d856a721a4dc2cc6c7a7823cb74
+  git checkout -f f143e7b8006d98e4bea47f39ebb5e1b3053f34f4
 
 RUN \
   echo "**** build shared core library ****" && \
@@ -186,7 +186,7 @@ RUN \
     | awk '/tag_name/{print $4;exit}' FS='[""]') && \
   curl -o \
     /tmp/selkies.tar.gz -L \
-    "https://github.com/selkies-project/selkies/archive/7cf9ad486b370d856a721a4dc2cc6c7a7823cb74.tar.gz" && \
+    "https://github.com/selkies-project/selkies/archive/f143e7b8006d98e4bea47f39ebb5e1b3053f34f4.tar.gz" && \
   cd /tmp && \
   tar xf selkies.tar.gz && \
   cd selkies-* && \

Dockerfile.aarch64

@@ -16,7 +16,7 @@ RUN \
     https://github.com/selkies-project/selkies.git \
     /src && \
   cd /src && \
-  git checkout -f 7cf9ad486b370d856a721a4dc2cc6c7a7823cb74
+  git checkout -f f143e7b8006d98e4bea47f39ebb5e1b3053f34f4
 
 RUN \
   echo "**** build shared core library ****" && \
@@ -184,7 +184,7 @@ RUN \
     | awk '/tag_name/{print $4;exit}' FS='[""]') && \
   curl -o \
     /tmp/selkies.tar.gz -L \
-    "https://github.com/selkies-project/selkies/archive/7cf9ad486b370d856a721a4dc2cc6c7a7823cb74.tar.gz" && \
+    "https://github.com/selkies-project/selkies/archive/f143e7b8006d98e4bea47f39ebb5e1b3053f34f4.tar.gz" && \
   cd /tmp && \
   tar xf selkies.tar.gz && \
   cd selkies-* && \

root/defaults/default.conf

@@ -43,6 +43,10 @@ server {
     fancyindex_footer SUBFOLDERnginx/footer.html;
     fancyindex_header SUBFOLDERnginx/header.html;
     alias REPLACE_DOWNLOADS_PATH/;
+    if (-f $request_filename) {
+        add_header Content-Disposition "attachment";
+        add_header X-Content-Type-Options "nosniff";
+    }
   }
   error_page 500 502 503 504 /50x.html;
   location = SUBFOLDER50x.html {
@@ -97,6 +101,10 @@ server {
     fancyindex_footer SUBFOLDERnginx/footer.html;
     fancyindex_header SUBFOLDERnginx/header.html;
     alias REPLACE_DOWNLOADS_PATH/;
+    if (-f $request_filename) {
+        add_header Content-Disposition "attachment";
+        add_header X-Content-Type-Options "nosniff";
+    }
   } 
   error_page 500 502 503 504 /50x.html;
   location = SUBFOLDER50x.html {

root/etc/s6-overlay/s6-rc.d/init-nginx/run

@@ -11,6 +11,8 @@ CUSER="${CUSTOM_USER:-abc}"
 SFOLDER="${SUBFOLDER:-/}"
 FILE_MANAGER_PATH="${FILE_MANAGER_PATH:-$HOME/Desktop}"
 DASHBOARD="${DASHBOARD:-selkies-dashboard}"
+SELKIES_FILE_TRANSFERS="${SELKIES_FILE_TRANSFERS:-upload,download}"
+HARDEN_DESKTOP="${HARDEN_DESKTOP:-false}"
 
 # create self signed cert
 if [ ! -f "/config/ssl/cert.pem" ]; then
@@ -31,7 +33,10 @@ sed -i "s/3001/$CHPORT/g" ${NGINX_CONFIG}
 sed -i "s/CWS/$CWS/g" ${NGINX_CONFIG}
 sed -i "s|SUBFOLDER|$SFOLDER|g" ${NGINX_CONFIG}
 sed -i "s|REPLACE_DOWNLOADS_PATH|$FILE_MANAGER_PATH|g" ${NGINX_CONFIG}
-s6-setuidgid abc mkdir -p $HOME/Desktop
+s6-setuidgid abc mkdir -p ${FILE_MANAGER_PATH}
+if [[ $SELKIES_FILE_TRANSFERS != *"download"* ]] || [[ ${HARDEN_DESKTOP,,} == "true" ]]; then
+  sed -i '/files {/,/}/d' ${NGINX_CONFIG}
+fi
 if [ ! -z ${DISABLE_IPV6+x} ]; then
   sed -i '/listen \[::\]/d' ${NGINX_CONFIG}
 fi
@@ -55,8 +60,10 @@ cp -a \
 sed -i "s|REPLACE_DOWNLOADS_PATH|$FILE_MANAGER_PATH|g" /usr/share/selkies/web/nginx/footer.html
 cp \
   /usr/share/selkies/www/icon.png \
-  /usr/share/selkies/$DASHBOARD/favicon.ico \
-  /usr/share/selkies/$DASHBOARD/icon.png
+  /usr/share/selkies/web/favicon.ico
+cp \
+  /usr/share/selkies/www/icon.png \
+  /usr/share/selkies/web/icon.png
 # manifest creation
 echo "{
   \"name\": \"${TITLE}\",