From fafedaf5755af4f4a5dadd3eaa4009c813e8aec5 Mon Sep 17 00:00:00 2001
From: Jan Pecek <pecek@internettrading.cz>
Date: Sun, 15 Apr 2012 19:57:39 +0200
Subject: [PATCH 1/2] Improve X-Content-Security-Policy header to work in FF,
 Chrome and Opera; but loading version.js script is still disabled in main.php
 (due to https), BugID: 3426500

---
 libraries/header_http.inc.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php
index 337fe4796a..9873c5dbdf 100644
--- a/libraries/header_http.inc.php
+++ b/libraries/header_http.inc.php
@@ -22,7 +22,8 @@ $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
 /* Prevent against ClickJacking by allowing frames only from same origin */
 if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) {
     header('X-Frame-Options: SAMEORIGIN');
-    header('X-Content-Security-Policy: allow \'self\'; options inline-script eval-script; frame-ancestors \'self\'; img-src \'self\' data:; script-src \'self\' www.phpmyadmin.net');
+    header('X-Content-Security-Policy: allow \'self\'; options inline-script eval-script; frame-ancestors \'self\'; img-src \'self\' data:; script-src \'self\' http://www.phpmyadmin.net');
+    header('X-WebKit-CSP: default-src \'self\' \'unsafe-inline\'; img-src \'self\' data:; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' http://www.phpmyadmin.net');
 }
 PMA_no_cache_header();
 if (!defined('IS_TRANSFORMATION_WRAPPER')) {

From f7b91e6c96d63f84fd43431844a8588c824ac470 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <mcihar@suse.cz>
Date: Mon, 16 Apr 2012 14:14:40 +0200
Subject: [PATCH 2/2] Disable version check only for IE as it does not support
 CSP

---
 main.php | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/main.php b/main.php
index e918482085..e05b639787 100644
--- a/main.php
+++ b/main.php
@@ -228,10 +228,9 @@ echo '<div class="group pmagroup">';
 echo '<h2>phpMyAdmin</h2>';
 echo '<ul>';
 $class = null;
-// workaround for bug 3302733; some browsers don't like the situation
-// where phpMyAdmin is called on a secure page but a part of the page
-// (the version check) refers to a non-secure page
-if ($GLOBALS['cfg']['VersionCheck'] && ! $GLOBALS['PMA_Config']->get('is_https')) {
+// We rely on CSP to allow access to http://www.phpmyadmin.net, but IE lacks
+// support here and does not allow request to http once using https.
+if ($GLOBALS['cfg']['VersionCheck'] && (! $GLOBALS['PMA_Config']->get('is_https') || PMA_USR_BROWSER_AGENT != 'IE')) {
     $class = 'jsversioncheck';
 }
 PMA_printListItem(__('Version information') . ': ' . PMA_VERSION, 'li_pma_version', null, null, null, null, $class);