From bc3e4c8fa4bae9591166e12caa3fb6bf73893102 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Sun, 21 Sep 2025 13:29:58 +0200 Subject: Add option for CSP frame-ancestors (#7857) * Add option for CSP frame-ancestors https://github.com/FreshRSS/FreshRSS/discussions/7856 * Revert contentSelectorPreviewAction * Same for f.php and api * Fix double init in f.php * No sandbox for API page --- app/Controllers/indexController.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'app/Controllers/indexController.php') diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php index 736cc8258..7c66d308a 100644 --- a/app/Controllers/indexController.php +++ b/app/Controllers/indexController.php @@ -58,7 +58,7 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { 'default-src' => "'self'", 'frame-src' => '*', 'img-src' => '* data: blob:', - 'frame-ancestors' => "'none'", + 'frame-ancestors' => FreshRSS_Context::systemConf()->attributeString('csp.frame-ancestors') ?? "'none'", 'media-src' => '*', ]); @@ -147,7 +147,7 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { 'default-src' => "'self'", 'frame-src' => '*', 'img-src' => '* data: blob:', - 'frame-ancestors' => "'none'", + 'frame-ancestors' => FreshRSS_Context::systemConf()->attributeString('csp.frame-ancestors') ?? "'none'", 'media-src' => '*', ]); } -- cgit v1.2.3