Show warning when unsafe CSP policy is in use (#7804)

* Show warning when unsafe CSP policy is in use

* Fix bare markdown URL

* i18n: fr

* Minor i18n: fr

* Add target="_blank" to i18n strings

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

7 files changed, 29 insertions, 11 deletions

diff --git a/docs/en/admins/10_ServerConfig.md b/docs/en/admins/10_ServerConfig.md
index 07ea147b6..54f4f0fb4 100644
--- a/docs/en/admins/10_ServerConfig.md
+++ b/docs/en/admins/10_ServerConfig.md
@@ -112,3 +112,21 @@ server {
 	}
 }
 ```
+
+## Security
+
+Avoid overwriting the [`Content-Security-Policy`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) header with directives such as `more_set_headers "Content-Security-Policy: ..."`
+This will likely make your FreshRSS instance vulnerable to event handler XSS attacks, since FreshRSS does not yet blacklist all event attributes.
+
+✅ Example of good CSP: `default-src 'self' frame-ancestors 'self'`
+❌ Bad CSP: `upgrade-insecure-requests`
+
+Debug CSP header:
+* With DevTools network tab: press F12
+* [CSP Evaluator](https://csp-evaluator.withgoogle.com/)
+
+If you're aware of the risks and want to ignore the warning shown to admin users, change the `suppress_csp_warning` setting to `true` in `./data/config.php`
+
+Note that FreshRSS already ships with a secure CSP configuration, therefore it's not necessary to make any adjustments to CSP unless you're writing an extension.
+
+For that, look into the [`Minz_ActionController::_csp`](https://github.com/FreshRSS/FreshRSS/blob/d9197d7e32a97f29829ffd4cf4371b1853e51fa2/lib/Minz/ActionController.php#L76-L96) function and use it in individual actions.
diff --git a/docs/i18n/flags/gen/cs.svg b/docs/i18n/flags/gen/cs.svg
index b997fd620..dba66087d 100644
--- a/docs/i18n/flags/gen/cs.svg
+++ b/docs/i18n/flags/gen/cs.svg
@@ -1,7 +1,7 @@
 <!-- This file is automatically generated by `cli/check.translation.php -g` -->
 <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20">
 	<g fill="white" font-size="12" font-family="Verdana" text-anchor="middle">
-		<rect rx="3" width="70" height="20" fill="green" />
-		<text x="34" y="14">🇨🇿 90%</text>
+		<rect rx="3" width="70" height="20" fill="gold" />
+		<text x="34" y="14">🇨🇿 89%</text>
 	</g>
 </svg>
\ No newline at end of file
diff --git a/docs/i18n/flags/gen/ja.svg b/docs/i18n/flags/gen/ja.svg
index 82d7b683c..e14f6bd58 100644
--- a/docs/i18n/flags/gen/ja.svg
+++ b/docs/i18n/flags/gen/ja.svg
@@ -2,6 +2,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20">
 	<g fill="white" font-size="12" font-family="Verdana" text-anchor="middle">
 		<rect rx="3" width="70" height="20" fill="green" />
-		<text x="34" y="14">🇯🇵 97%</text>
+		<text x="34" y="14">🇯🇵 96%</text>
 	</g>
 </svg>
\ No newline at end of file
diff --git a/docs/i18n/flags/gen/ko.svg b/docs/i18n/flags/gen/ko.svg
index 7ad71b132..bde6a488c 100644
--- a/docs/i18n/flags/gen/ko.svg
+++ b/docs/i18n/flags/gen/ko.svg
@@ -1,7 +1,7 @@
 <!-- This file is automatically generated by `cli/check.translation.php -g` -->
 <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20">
 	<g fill="white" font-size="12" font-family="Verdana" text-anchor="middle">
-		<rect rx="3" width="70" height="20" fill="green" />
-		<text x="34" y="14">🇰🇷 90%</text>
+		<rect rx="3" width="70" height="20" fill="gold" />
+		<text x="34" y="14">🇰🇷 89%</text>
 	</g>
 </svg>
\ No newline at end of file
diff --git a/docs/i18n/flags/gen/ru.svg b/docs/i18n/flags/gen/ru.svg
index b7b471ce1..01426a5df 100644
--- a/docs/i18n/flags/gen/ru.svg
+++ b/docs/i18n/flags/gen/ru.svg
@@ -1,7 +1,7 @@
 <!-- This file is automatically generated by `cli/check.translation.php -g` -->
 <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20">
 	<g fill="white" font-size="12" font-family="Verdana" text-anchor="middle">
-		<rect rx="3" width="70" height="20" fill="green" />
-		<text x="34" y="14">🇷🇺 90%</text>
+		<rect rx="3" width="70" height="20" fill="gold" />
+		<text x="34" y="14">🇷🇺 89%</text>
 	</g>
 </svg>
\ No newline at end of file
diff --git a/docs/i18n/flags/gen/zh-cn.svg b/docs/i18n/flags/gen/zh-cn.svg
index 27e539722..41339b5f6 100644
--- a/docs/i18n/flags/gen/zh-cn.svg
+++ b/docs/i18n/flags/gen/zh-cn.svg
@@ -1,7 +1,7 @@
 <!-- This file is automatically generated by `cli/check.translation.php -g` -->
 <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20">
 	<g fill="white" font-size="12" font-family="Verdana" text-anchor="middle">
-		<rect rx="3" width="70" height="20" fill="green" />
-		<text x="34" y="14">🇨🇳 90%</text>
+		<rect rx="3" width="70" height="20" fill="gold" />
+		<text x="34" y="14">🇨🇳 89%</text>
 	</g>
 </svg>
\ No newline at end of file
diff --git a/docs/i18n/flags/gen/zh-tw.svg b/docs/i18n/flags/gen/zh-tw.svg
index 66ddcb170..18374e310 100644
--- a/docs/i18n/flags/gen/zh-tw.svg
+++ b/docs/i18n/flags/gen/zh-tw.svg
@@ -1,7 +1,7 @@
 <!-- This file is automatically generated by `cli/check.translation.php -g` -->
 <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20">
 	<g fill="white" font-size="12" font-family="Verdana" text-anchor="middle">
-		<rect rx="3" width="70" height="20" fill="green" />
-		<text x="34" y="14">🇹🇼 90%</text>
+		<rect rx="3" width="70" height="20" fill="gold" />
+		<text x="34" y="14">🇹🇼 89%</text>
 	</g>
 </svg>
\ No newline at end of file