From 7df6c201f2e6a6521d20718dfd8d9794c7437d1f Mon Sep 17 00:00:00 2001 From: Inverle Date: Mon, 11 Aug 2025 19:35:54 +0200 Subject: Put CSP everywhere (#7810) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Puts CSP everywhere in `p/api` * including the HTML query page ❗ * Also in `p/ext.php` * Puts `X-Content-Type-Options: nosniff` everywhere * Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds) * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed * Improves CSP of `p/f.php` * Add `sandbox` directive --- app/Controllers/statsController.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'app/Controllers/statsController.php') diff --git a/app/Controllers/statsController.php b/app/Controllers/statsController.php index 67b1f80e9..5a7e9b79a 100644 --- a/app/Controllers/statsController.php +++ b/app/Controllers/statsController.php @@ -30,8 +30,7 @@ class FreshRSS_stats_Controller extends FreshRSS_ActionController { $this->_csp([ 'default-src' => "'self'", 'frame-ancestors' => "'none'", - 'img-src' => '* data:', - 'style-src' => "'self' 'unsafe-inline'", + 'img-src' => '* data: blob:', ]); $catDAO = FreshRSS_Factory::createCategoryDao(); -- cgit v1.2.3