From a6948218fb1c66fe146c7651555e5a1f791c8112 Mon Sep 17 00:00:00 2001 From: Inverle Date: Wed, 18 Jun 2025 22:20:17 +0200 Subject: frame-ancestors CSP (#7677) --- app/Controllers/feedController.php | 1 + app/Controllers/indexController.php | 2 ++ app/Controllers/statsController.php | 1 + 3 files changed, 4 insertions(+) (limited to 'app/Controllers') diff --git a/app/Controllers/feedController.php b/app/Controllers/feedController.php index 9769a6df0..35b209a4d 100755 --- a/app/Controllers/feedController.php +++ b/app/Controllers/feedController.php @@ -1150,6 +1150,7 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController { $this->_csp([ 'default-src' => "'self'", + 'frame-ancestors' => "'self'", 'frame-src' => '*', 'img-src' => '* data:', 'media-src' => '*', diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php index 1f49e03ee..661e8300b 100644 --- a/app/Controllers/indexController.php +++ b/app/Controllers/indexController.php @@ -50,6 +50,7 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { 'default-src' => "'self'", 'frame-src' => '*', 'img-src' => '* data:', + 'frame-ancestors' => "'none'", 'media-src' => '*', ]); @@ -138,6 +139,7 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { 'default-src' => "'self'", 'frame-src' => '*', 'img-src' => '* data:', + 'frame-ancestors' => "'none'", 'media-src' => '*', ]); } diff --git a/app/Controllers/statsController.php b/app/Controllers/statsController.php index 7a7180176..8759eae9d 100644 --- a/app/Controllers/statsController.php +++ b/app/Controllers/statsController.php @@ -29,6 +29,7 @@ class FreshRSS_stats_Controller extends FreshRSS_ActionController { $this->_csp([ 'default-src' => "'self'", + 'frame-ancestors' => "'none'", 'img-src' => '* data:', 'style-src' => "'self' 'unsafe-inline'", ]); -- cgit v1.2.3