diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2025-09-21 13:29:58 +0200 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2025-09-21 13:29:58 +0200 |
| commit | bc3e4c8fa4bae9591166e12caa3fb6bf73893102 (patch) | |
| tree | ee38afd776e08461ba22bdbc10fe4c17d5bff172 /p/api/index.php | |
| parent | f1cf57b5b713527b4521c4552b5f1ac023ee3adc (diff) | |
Add option for CSP frame-ancestors (#7857)
* Add option for CSP frame-ancestors
https://github.com/FreshRSS/FreshRSS/discussions/7856
* Revert contentSelectorPreviewAction
* Same for f.php and api
* Fix double init in f.php
* No sandbox for API page
Diffstat (limited to 'p/api/index.php')
| -rw-r--r-- | p/api/index.php | 20 |
1 files changed, 13 insertions, 7 deletions
diff --git a/p/api/index.php b/p/api/index.php index 279826aa5..03db02188 100644 --- a/p/api/index.php +++ b/p/api/index.php @@ -1,12 +1,18 @@ <?php - declare(strict_types=1); - require dirname(__DIR__, 2) . '/constants.php'; - require LIB_PATH . '/lib_rss.php'; //Includes class autoloader - header("Content-Security-Policy: default-src 'self'; frame-ancestors 'none'"); - header('X-Content-Type-Options: nosniff'); +declare(strict_types=1); +require dirname(__DIR__, 2) . '/constants.php'; +require LIB_PATH . '/lib_rss.php'; //Includes class autoloader - FreshRSS_Context::initSystem(); - Minz_Translate::init(Minz_Translate::getLanguage(null, Minz_Request::getPreferredLanguages(), null)); +FreshRSS_Context::initSystem(); +if (!FreshRSS_Context::hasSystemConf()) { + header('HTTP/1.1 500 Internal Server Error'); + die('Invalid system init!'); +} +$frameAncestors = FreshRSS_Context::systemConf()->attributeString('csp.frame-ancestors') ?? "'none'"; +header("Content-Security-Policy: default-src 'self'; frame-ancestors $frameAncestors"); +header('X-Content-Type-Options: nosniff'); + +Minz_Translate::init(Minz_Translate::getLanguage(null, Minz_Request::getPreferredLanguages(), null)); ?> <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-GB" lang="en-GB"> |