From 7df6c201f2e6a6521d20718dfd8d9794c7437d1f Mon Sep 17 00:00:00 2001 From: Inverle Date: Mon, 11 Aug 2025 19:35:54 +0200 Subject: Put CSP everywhere (#7810) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Puts CSP everywhere in `p/api` * including the HTML query page ❗ * Also in `p/ext.php` * Puts `X-Content-Type-Options: nosniff` everywhere * Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds) * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed * Improves CSP of `p/f.php` * Add `sandbox` directive --- p/api/pshb.php | 1 + 1 file changed, 1 insertion(+) (limited to 'p/api/pshb.php') diff --git a/p/api/pshb.php b/p/api/pshb.php index 91dd4e901..b6cbc5089 100644 --- a/p/api/pshb.php +++ b/p/api/pshb.php @@ -6,6 +6,7 @@ require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader const MAX_PAYLOAD = 3_145_728; header('Content-Type: text/plain; charset=UTF-8'); +header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); header('X-Content-Type-Options: nosniff'); $ORIGINAL_INPUT = file_get_contents('php://input', false, null, 0, MAX_PAYLOAD) ?: ''; -- cgit v1.2.3