diff options
| author |  Inverle <inverle@proton.me>
| 2025-08-11 19:35:54 +0200 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2025-08-11 19:35:54 +0200 |
| commit | 7df6c201f2e6a6521d20718dfd8d9794c7437d1f (patch) | |
| tree | fbd88eb2c462808b16e9ee476b3c619e3b2bb20c /app/FreshRSS.php | |
| parent | 2b1b268fc27268197b8c86ed839bf22daab79438 (diff) | |
Put CSP everywhere (#7810)
* Puts CSP everywhere in `p/api`
* including the HTML query page ❗
* Also in `p/ext.php`
* Puts `X-Content-Type-Options: nosniff` everywhere
* Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds)
* Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed
* Improves CSP of `p/f.php`
* Add `sandbox` directive
Diffstat (limited to 'app/FreshRSS.php')
| -rw-r--r-- | app/FreshRSS.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/FreshRSS.php b/app/FreshRSS.php index bff9f1b18..62e91ff95 100644 --- a/app/FreshRSS.php +++ b/app/FreshRSS.php @@ -149,7 +149,7 @@ class FreshRSS extends Minz_FrontController { } public static function preLayout(): void { - header("X-Content-Type-Options: nosniff"); + header('X-Content-Type-Options: nosniff'); FreshRSS_Share::load(join_path(APP_PATH, 'shares.php')); self::loadStylesAndScripts(); |