AS1024
/
itflow
mirror of https://github.com/itflow-org/itflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

CSP - Client Portal Test 

Add initial content security policy trial/test to some client portal pages
This commit is contained in:
Marcus Hill 2023-04-29 19:39:42 +01:00
parent ca0024feb9
commit 0340b080ad
6 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
portal/index.php
View File

@ -4,6 +4,8 @@
* Landing / Home page for the client portal
*/
header("Content-Security-Policy: default-src 'self' https: fonts.googleapis.com");
require_once("inc_portal.php");
?>

2
portal/invoices.php
View File

@ -4,6 +4,8 @@
* Invoices for PTC
*/
header("Content-Security-Policy: default-src 'self' https: fonts.googleapis.com");
require_once("inc_portal.php");
if ($session_contact_id !== $session_client_primary_contact_id && !$session_contact_is_billing_contact) {

2
portal/login.php
View File

@ -4,6 +4,8 @@
* Landing / Home page for the client portal
*/
header("Content-Security-Policy: default-src 'self' https: fonts.googleapis.com");
header("X-Frame-Options: DENY");
$session_company_id = 1;

4
portal/portal_header.php
View File

@ -4,7 +4,7 @@
* HTML Header
*/
header("X-Frame-Options: DENY");
header("X-Frame-Options: DENY"); // Legacy
?>
<!DOCTYPE html>
@ -12,7 +12,7 @@ header("X-Frame-Options: DENY");
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title><?php echo htmlentities($company_name); ?> | Client Portal - Tickets</title>
<title><?php echo htmlentities($company_name); ?> | Client Portal</title>
<!-- Tell the browser to be responsive to screen width -->
<meta name="viewport" content="width=device-width, initial-scale=1">

2
portal/profile.php
View File

@ -4,6 +4,8 @@
* User profile
*/
header("Content-Security-Policy: default-src 'self' https: fonts.googleapis.com");
require_once('inc_portal.php');
?>

2
portal/tickets.php
View File

@ -4,6 +4,8 @@
* Landing / Home page for the client portal
*/
header("Content-Security-Policy: default-src 'self' https: fonts.googleapis.com");
require_once("inc_portal.php");
// Ticket status from GET