From 7802fd33a627dc7c582df871cfa613d9be8f8788 Mon Sep 17 00:00:00 2001 From: Marien Fressinaud Date: Sat, 7 Dec 2019 19:29:23 +0100 Subject: tec: Allow to change CSP header from controllers For an extension, I needed to call a script from an external domain. Unfortunately, the CSP headers didn't allow this domain and I had to patch manually the FreshRSS FrontController for my extension. It's obviously not a long-term solution since it has nothing to do in the core of FRSS, and I don't want to apply this patch manually at each update. With this patch, I allow changing the CSP header from inside the controller actions. It allows extensions to modify headers. It's also an opportunity to remove a bit of code from the FrontController. I wasn't happy with the previous implementation anyhow. Reference: https://github.com/flusio/xExtension-Flus/commit/ed12d56#diff-ff12e33ed31b23bda327499fa6e84eccR143 --- app/Controllers/indexController.php | 14 ++++++++++++++ app/Controllers/statsController.php | 5 +++++ 2 files changed, 19 insertions(+) (limited to 'app/Controllers') diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php index 967029fd1..276d56acd 100755 --- a/app/Controllers/indexController.php +++ b/app/Controllers/indexController.php @@ -83,6 +83,13 @@ class FreshRSS_index_Controller extends Minz_ActionController { Minz_Error::error(404); } }; + + $this->_csp([ + 'default-src' => "'self'", + 'frame-src' => '*', + 'img-src' => '* data:', + 'media-src' => '*', + ]); } /** @@ -121,6 +128,13 @@ class FreshRSS_index_Controller extends Minz_ActionController { $title = '(' . FreshRSS_Context::$get_unread . ') ' . $title; } Minz_View::prependTitle($title . ' · '); + + $this->_csp([ + 'default-src' => "'self'", + 'frame-src' => '*', + 'img-src' => '* data:', + 'media-src' => '*', + ]); } /** diff --git a/app/Controllers/statsController.php b/app/Controllers/statsController.php index 1d0d9c124..0d7d8f65a 100644 --- a/app/Controllers/statsController.php +++ b/app/Controllers/statsController.php @@ -15,6 +15,11 @@ class FreshRSS_stats_Controller extends Minz_ActionController { Minz_Error::error(403); } + $this->_csp([ + 'default-src' => "'self'", + 'style-src' => "'self' 'unsafe-inline'", + ]); + Minz_View::prependTitle(_t('admin.stats.title') . ' · '); } -- cgit v1.2.3