From bc3e4c8fa4bae9591166e12caa3fb6bf73893102 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Sun, 21 Sep 2025 13:29:58 +0200 Subject: Add option for CSP frame-ancestors (#7857) * Add option for CSP frame-ancestors https://github.com/FreshRSS/FreshRSS/discussions/7856 * Revert contentSelectorPreviewAction * Same for f.php and api * Fix double init in f.php * No sandbox for API page --- p/api/index.php | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'p/api/index.php') diff --git a/p/api/index.php b/p/api/index.php index 279826aa5..03db02188 100644 --- a/p/api/index.php +++ b/p/api/index.php @@ -1,12 +1,18 @@ attributeString('csp.frame-ancestors') ?? "'none'"; +header("Content-Security-Policy: default-src 'self'; frame-ancestors $frameAncestors"); +header('X-Content-Type-Options: nosniff'); + +Minz_Translate::init(Minz_Translate::getLanguage(null, Minz_Request::getPreferredLanguages(), null)); ?> -- cgit v1.2.3