diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/en/admins/10_ServerConfig.md | 18 | ||||
| -rw-r--r-- | docs/i18n/flags/gen/cs.svg | 4 | ||||
| -rw-r--r-- | docs/i18n/flags/gen/ja.svg | 2 | ||||
| -rw-r--r-- | docs/i18n/flags/gen/ko.svg | 4 | ||||
| -rw-r--r-- | docs/i18n/flags/gen/ru.svg | 4 | ||||
| -rw-r--r-- | docs/i18n/flags/gen/zh-cn.svg | 4 | ||||
| -rw-r--r-- | docs/i18n/flags/gen/zh-tw.svg | 4 |
7 files changed, 29 insertions, 11 deletions
diff --git a/docs/en/admins/10_ServerConfig.md b/docs/en/admins/10_ServerConfig.md index 07ea147b6..54f4f0fb4 100644 --- a/docs/en/admins/10_ServerConfig.md +++ b/docs/en/admins/10_ServerConfig.md @@ -112,3 +112,21 @@ server { } } ``` + +## Security + +Avoid overwriting the [`Content-Security-Policy`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) header with directives such as `more_set_headers "Content-Security-Policy: ..."` +This will likely make your FreshRSS instance vulnerable to event handler XSS attacks, since FreshRSS does not yet blacklist all event attributes. + +✅ Example of good CSP: `default-src 'self' frame-ancestors 'self'` +❌ Bad CSP: `upgrade-insecure-requests` + +Debug CSP header: +* With DevTools network tab: press F12 +* [CSP Evaluator](https://csp-evaluator.withgoogle.com/) + +If you're aware of the risks and want to ignore the warning shown to admin users, change the `suppress_csp_warning` setting to `true` in `./data/config.php` + +Note that FreshRSS already ships with a secure CSP configuration, therefore it's not necessary to make any adjustments to CSP unless you're writing an extension. + +For that, look into the [`Minz_ActionController::_csp`](https://github.com/FreshRSS/FreshRSS/blob/d9197d7e32a97f29829ffd4cf4371b1853e51fa2/lib/Minz/ActionController.php#L76-L96) function and use it in individual actions. diff --git a/docs/i18n/flags/gen/cs.svg b/docs/i18n/flags/gen/cs.svg index b997fd620..dba66087d 100644 --- a/docs/i18n/flags/gen/cs.svg +++ b/docs/i18n/flags/gen/cs.svg @@ -1,7 +1,7 @@ <!-- This file is automatically generated by `cli/check.translation.php -g` --> <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20"> <g fill="white" font-size="12" font-family="Verdana" text-anchor="middle"> - <rect rx="3" width="70" height="20" fill="green" /> - <text x="34" y="14">🇨🇿 90%</text> + <rect rx="3" width="70" height="20" fill="gold" /> + <text x="34" y="14">🇨🇿 89%</text> </g> </svg>
\ No newline at end of file diff --git a/docs/i18n/flags/gen/ja.svg b/docs/i18n/flags/gen/ja.svg index 82d7b683c..e14f6bd58 100644 --- a/docs/i18n/flags/gen/ja.svg +++ b/docs/i18n/flags/gen/ja.svg @@ -2,6 +2,6 @@ <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20"> <g fill="white" font-size="12" font-family="Verdana" text-anchor="middle"> <rect rx="3" width="70" height="20" fill="green" /> - <text x="34" y="14">🇯🇵 97%</text> + <text x="34" y="14">🇯🇵 96%</text> </g> </svg>
\ No newline at end of file diff --git a/docs/i18n/flags/gen/ko.svg b/docs/i18n/flags/gen/ko.svg index 7ad71b132..bde6a488c 100644 --- a/docs/i18n/flags/gen/ko.svg +++ b/docs/i18n/flags/gen/ko.svg @@ -1,7 +1,7 @@ <!-- This file is automatically generated by `cli/check.translation.php -g` --> <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20"> <g fill="white" font-size="12" font-family="Verdana" text-anchor="middle"> - <rect rx="3" width="70" height="20" fill="green" /> - <text x="34" y="14">🇰🇷 90%</text> + <rect rx="3" width="70" height="20" fill="gold" /> + <text x="34" y="14">🇰🇷 89%</text> </g> </svg>
\ No newline at end of file diff --git a/docs/i18n/flags/gen/ru.svg b/docs/i18n/flags/gen/ru.svg index b7b471ce1..01426a5df 100644 --- a/docs/i18n/flags/gen/ru.svg +++ b/docs/i18n/flags/gen/ru.svg @@ -1,7 +1,7 @@ <!-- This file is automatically generated by `cli/check.translation.php -g` --> <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20"> <g fill="white" font-size="12" font-family="Verdana" text-anchor="middle"> - <rect rx="3" width="70" height="20" fill="green" /> - <text x="34" y="14">🇷🇺 90%</text> + <rect rx="3" width="70" height="20" fill="gold" /> + <text x="34" y="14">🇷🇺 89%</text> </g> </svg>
\ No newline at end of file diff --git a/docs/i18n/flags/gen/zh-cn.svg b/docs/i18n/flags/gen/zh-cn.svg index 27e539722..41339b5f6 100644 --- a/docs/i18n/flags/gen/zh-cn.svg +++ b/docs/i18n/flags/gen/zh-cn.svg @@ -1,7 +1,7 @@ <!-- This file is automatically generated by `cli/check.translation.php -g` --> <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20"> <g fill="white" font-size="12" font-family="Verdana" text-anchor="middle"> - <rect rx="3" width="70" height="20" fill="green" /> - <text x="34" y="14">🇨🇳 90%</text> + <rect rx="3" width="70" height="20" fill="gold" /> + <text x="34" y="14">🇨🇳 89%</text> </g> </svg>
\ No newline at end of file diff --git a/docs/i18n/flags/gen/zh-tw.svg b/docs/i18n/flags/gen/zh-tw.svg index 66ddcb170..18374e310 100644 --- a/docs/i18n/flags/gen/zh-tw.svg +++ b/docs/i18n/flags/gen/zh-tw.svg @@ -1,7 +1,7 @@ <!-- This file is automatically generated by `cli/check.translation.php -g` --> <svg xmlns="http://www.w3.org/2000/svg" width="70" height="20"> <g fill="white" font-size="12" font-family="Verdana" text-anchor="middle"> - <rect rx="3" width="70" height="20" fill="green" /> - <text x="34" y="14">🇹🇼 90%</text> + <rect rx="3" width="70" height="20" fill="gold" /> + <text x="34" y="14">🇹🇼 89%</text> </g> </svg>
\ No newline at end of file |
