diff options
Diffstat (limited to 'p/api/query.php')
| -rw-r--r-- | p/api/query.php | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/p/api/query.php b/p/api/query.php index 5deedc932..f7458e823 100644 --- a/p/api/query.php +++ b/p/api/query.php @@ -1,5 +1,8 @@ <?php declare(strict_types=1); + +header('X-Content-Type-Options: nosniff'); + require(__DIR__ . '/../../constants.php'); require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader @@ -175,10 +178,12 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') { if (in_array($format, ['rss', 'atom'], true)) { header('Content-Type: application/rss+xml; charset=utf-8'); + header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); $view->_layout(null); $view->_path('index/rss.phtml'); } elseif (in_array($format, ['greader', 'json'], true)) { header('Content-Type: application/json; charset=utf-8'); + header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); $view->_layout(null); $view->type = 'query/' . $token; $view->list_title = $query->getName(); @@ -190,9 +195,11 @@ if (in_array($format, ['rss', 'atom'], true)) { die(); } header('Content-Type: application/xml; charset=utf-8'); + header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); $view->_layout(null); $view->_path('index/opml.phtml'); } else { + header("Content-Security-Policy: default-src 'self'; frame-src *; img-src * data:; frame-ancestors 'none'; media-src *"); $view->_layout('layout'); $view->_path('index/html.phtml'); } |