diff options
Diffstat (limited to 'app')
| -rwxr-xr-x | app/Controllers/indexController.php | 14 | ||||
| -rw-r--r-- | app/Controllers/statsController.php | 5 | ||||
| -rw-r--r-- | app/FreshRSS.php | 17 |
3 files changed, 19 insertions, 17 deletions
diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php index 967029fd1..276d56acd 100755 --- a/app/Controllers/indexController.php +++ b/app/Controllers/indexController.php @@ -83,6 +83,13 @@ class FreshRSS_index_Controller extends Minz_ActionController { Minz_Error::error(404); } }; + + $this->_csp([ + 'default-src' => "'self'", + 'frame-src' => '*', + 'img-src' => '* data:', + 'media-src' => '*', + ]); } /** @@ -121,6 +128,13 @@ class FreshRSS_index_Controller extends Minz_ActionController { $title = '(' . FreshRSS_Context::$get_unread . ') ' . $title; } Minz_View::prependTitle($title . ' · '); + + $this->_csp([ + 'default-src' => "'self'", + 'frame-src' => '*', + 'img-src' => '* data:', + 'media-src' => '*', + ]); } /** diff --git a/app/Controllers/statsController.php b/app/Controllers/statsController.php index 1d0d9c124..0d7d8f65a 100644 --- a/app/Controllers/statsController.php +++ b/app/Controllers/statsController.php @@ -15,6 +15,11 @@ class FreshRSS_stats_Controller extends Minz_ActionController { Minz_Error::error(403); } + $this->_csp([ + 'default-src' => "'self'", + 'style-src' => "'self' 'unsafe-inline'", + ]); + Minz_View::prependTitle(_t('admin.stats.title') . ' · '); } diff --git a/app/FreshRSS.php b/app/FreshRSS.php index 8d079b268..886e30323 100644 --- a/app/FreshRSS.php +++ b/app/FreshRSS.php @@ -124,23 +124,6 @@ class FreshRSS extends Minz_FrontController { } public static function preLayout() { - switch (Minz_Request::controllerName()) { - case 'index': - $urlToAuthorize = array_filter(array_map(function ($a) { - if (isset($a['method']) && $a['method'] === 'POST') { - return $a['url']; - } - }, FreshRSS_Context::$user_conf->sharing)); - $connectSrc = count($urlToAuthorize) ? sprintf("; connect-src 'self' %s", implode(' ', $urlToAuthorize)) : ''; - header(sprintf("Content-Security-Policy: default-src 'self'; frame-src *; img-src * data:; media-src *%s", $connectSrc)); - break; - case 'stats': - header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'"); - break; - default: - header("Content-Security-Policy: default-src 'self'"); - break; - } header("X-Content-Type-Options: nosniff"); FreshRSS_Share::load(join_path(APP_PATH, 'shares.php')); |