From 28443f6723c804e021d4fb20c64c482bf66986bc Mon Sep 17 00:00:00 2001 From: Dan Wallis Date: Mon, 3 Oct 2022 23:27:53 +0100 Subject: [PATCH] Send Content-Security-Policy headers in setup/ app (#17751) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This pull request adds Content-Security-Policy and other security-related headers to the setup/ application, as requested in #12359. Fixes #12359 Signed-off-by: Dan Wallis (cherry picked from commit 6e14811a0512955e83f4afb1f0f4c4e86c3803fa) Signed-off-by: Maurício Meneghini Fauth --- setup/index.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/setup/index.php b/setup/index.php index 2368f981b7..3f6ec03dfa 100644 --- a/setup/index.php +++ b/setup/index.php @@ -10,6 +10,7 @@ use PhpMyAdmin\Controllers\Setup\FormController; use PhpMyAdmin\Controllers\Setup\HomeController; use PhpMyAdmin\Controllers\Setup\ServersController; use PhpMyAdmin\Core; +use PhpMyAdmin\Header; use PhpMyAdmin\Template; use PhpMyAdmin\Url; @@ -39,6 +40,9 @@ if (isset($_GET['page']) && in_array($_GET['page'], ['form', 'config', 'servers' Core::noCacheHeader(); +// Sent security-related headers +(new Header())->sendHttpHeaders(); + if ($page === 'form') { echo (new FormController($GLOBALS['ConfigFile'], new Template()))([ 'formset' => $_GET['formset'] ?? null,