gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #13134 from ngyikp/master

Browse Source 
Add `object-src 'none'` to Content Security Policy header
This commit is contained in:
Michal Čihař 2017-04-03 09:51:47 +02:00 committed by GitHub
commit 37b87d7d44
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/Header.php
View File

@ -546,7 +546,6 @@ class Header
. "script-src 'self' 'unsafe-inline' 'unsafe-eval' "
. $captcha_url
. $GLOBALS['cfg']['CSPAllow'] . ';'
. ";"
. "style-src 'self' 'unsafe-inline' "
. $captcha_url
. $GLOBALS['cfg']['CSPAllow']
@ -556,6 +555,7 @@ class Header
. $map_tile_urls
. $captcha_url
. ";"
. "object-src 'none';"
);
header(
"X-Content-Security-Policy: default-src 'self' "
@ -568,6 +568,7 @@ class Header
. $map_tile_urls
. $captcha_url
. ";"
. "object-src 'none';"
);
header(
"X-WebKit-CSP: default-src 'self' "
@ -586,6 +587,7 @@ class Header
. $map_tile_urls
. $captcha_url
. ";"
. "object-src 'none';"
);
// Re-enable possible disabled XSS filters
// see https://www.owasp.org/index.php/List_of_useful_HTTP_headers