diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-02-21 21:25:48 +0100 |
|---|---|---|
| committer | Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-02-21 21:25:48 +0100 |
| commit | bb3f9e67ed0213fa32205213a51549872a2f5e84 (patch) | |
| tree | a31a6e2d0987b361966b08f305d4e9fb89c6644c /app/FreshRSS.php | |
| parent | 8d8bf4647bba0a0be2336f3eaeb8e6a70bfb9a37 (diff) | |
| parent | 38c2d671e3480b8e9fb38491797e44fdea317006 (diff) | |
Merge branch 'CSP-no-inline' into dev
Diffstat (limited to 'app/FreshRSS.php')
| -rw-r--r-- | app/FreshRSS.php | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/app/FreshRSS.php b/app/FreshRSS.php index 62ea18d96..bfbd7a6eb 100644 --- a/app/FreshRSS.php +++ b/app/FreshRSS.php @@ -111,10 +111,16 @@ class FreshRSS extends Minz_FrontController { } public static function preLayout() { - if (Minz_Request::controllerName() === 'stats') { - header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'"); - } else { - header("Content-Security-Policy: default-src 'self'; child-src *; img-src * data:; media-src *"); + switch (Minz_Request::controllerName()) { + case 'index': + header("Content-Security-Policy: default-src 'self'; child-src *; img-src * data:; media-src *"); + break; + case 'stats': + header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'"); + break; + default: + header("Content-Security-Policy: default-src 'self'"); + break; } } |