diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-02-21 19:15:23 +0100 |
|---|---|---|
| committer | Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-02-21 19:15:23 +0100 |
| commit | cb913a3a76daf357ad36ca39c26b4aaf800211d2 (patch) | |
| tree | 99eec0a9021ed4dd829e95ee3fa61de349789e9b /app/FreshRSS.php | |
| parent | b4864149889a749042d344625d4ffbdbd3f8a3cc (diff) | |
CSP for statistics and forms
https://github.com/FreshRSS/FreshRSS/issues/1075
Diffstat (limited to 'app/FreshRSS.php')
| -rw-r--r-- | app/FreshRSS.php | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/app/FreshRSS.php b/app/FreshRSS.php index a6ed2a306..62ea18d96 100644 --- a/app/FreshRSS.php +++ b/app/FreshRSS.php @@ -111,7 +111,11 @@ class FreshRSS extends Minz_FrontController { } public static function preLayout() { - header("Content-Security-Policy: default-src 'self'; child-src *; img-src * data:; media-src *; style-src 'self' 'unsafe-inline'"); + if (Minz_Request::controllerName() === 'stats') { + header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'"); + } else { + header("Content-Security-Policy: default-src 'self'; child-src *; img-src * data:; media-src *"); + } } private function loadNotifications() { |