AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move default-src CSP rule to ClassProvider

Browse Source 
It was impossible to override the default-src CSP rule inside a plugin. This commit
fixes this limitation by moving the assignation of the rule from Response class to
ClassProvider.
This commit is contained in:
Marien Fressinaud
2016-01-23 18:47:47 +01:00
parent cc93b86991
commit 8baa417ece
2 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
app/Core/Http/Response.php
View File

@@ -220,7 +220,6 @@ class Response extends Base
*/ */
public function csp(array $policies = array()) public function csp(array $policies = array())
{ {
$policies['default-src'] = "'self'";
$values = ''; $values = '';
foreach ($policies as $policy => $acl) { foreach ($policies as $policy => $acl) {

1
app/ServiceProvider/ClassProvider.php
View File

@@ -168,6 +168,7 @@ class ClassProvider implements ServiceProviderInterface
}; };
$container['cspRules'] = array( $container['cspRules'] = array(
'default-src' => "'self'",
'style-src' => "'self' 'unsafe-inline'", 'style-src' => "'self' 'unsafe-inline'",
'img-src' => '* data:', 'img-src' => '* data:',
); );