diff options
| author |  Marien Fressinaud <dev@marienfressinaud.fr>
| 2019-12-07 19:29:23 +0100 |
|---|---|---|
| committer | Marien Fressinaud <dev@marienfressinaud.fr>
| 2019-12-22 15:01:02 +0100 |
| commit | 7802fd33a627dc7c582df871cfa613d9be8f8788 (patch) | |
| tree | 475d6a11b3314561cb90c7d9c480e4620f1d8dac /app/Controllers/statsController.php | |
| parent | 2b1f8e67f76672a5b1b0a1b0403d81dbee364c58 (diff) | |
tec: Allow to change CSP header from controllers
For an extension, I needed to call a script from an external domain.
Unfortunately, the CSP headers didn't allow this domain and I had to
patch manually the FreshRSS FrontController for my extension. It's
obviously not a long-term solution since it has nothing to do in the
core of FRSS, and I don't want to apply this patch manually at each
update.
With this patch, I allow changing the CSP header from inside the
controller actions. It allows extensions to modify headers. It's also an
opportunity to remove a bit of code from the FrontController. I wasn't
happy with the previous implementation anyhow.
Reference: https://github.com/flusio/xExtension-Flus/commit/ed12d56#diff-ff12e33ed31b23bda327499fa6e84eccR143
Diffstat (limited to 'app/Controllers/statsController.php')
| -rw-r--r-- | app/Controllers/statsController.php | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/app/Controllers/statsController.php b/app/Controllers/statsController.php index 1d0d9c124..0d7d8f65a 100644 --- a/app/Controllers/statsController.php +++ b/app/Controllers/statsController.php @@ -15,6 +15,11 @@ class FreshRSS_stats_Controller extends Minz_ActionController { Minz_Error::error(403); } + $this->_csp([ + 'default-src' => "'self'", + 'style-src' => "'self' 'unsafe-inline'", + ]); + Minz_View::prependTitle(_t('admin.stats.title') . ' ยท '); } |