gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict map tile url to https protocol

Browse Source 
Signed-off-by: Maximilian Krög <maxi_kroeg@web.de>
This commit is contained in:
Maximilian Krög 2026-03-07 23:50:56 +01:00
parent e781d75a1e
commit 76be859196
No known key found for this signature in database
GPG Key ID: 3C00897BB53AAB9C
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Header.php
View File

@ -419,7 +419,7 @@ class Header
/** Get the Content-Security-Policy header */
private function getCspHeader(): string
{
$mapTileUrl = ' tile.openstreetmap.org';
$mapTileUrl = ' https://tile.openstreetmap.org';
$cspAllow = $this->config->config->CSPAllow === '' ? '' : ' ' . $this->config->config->CSPAllow;
$captchaUrl =
$this->config->config->CaptchaLoginPrivateKey === '' ||

7
tests/unit/HeaderTest.php
View File

@ -226,7 +226,7 @@ class HeaderTest extends AbstractTestCase
'',
'',
"default-src 'self';"
. " img-src 'self' data: tile.openstreetmap.org;"
. " img-src 'self' data: https://tile.openstreetmap.org;"
. " object-src 'none';"
. " script-src 'self' 'unsafe-inline' 'unsafe-eval';"
. " style-src 'self' 'unsafe-inline';"
@ -239,7 +239,8 @@ class HeaderTest extends AbstractTestCase
'PublicKey',
'captcha.tld csp.tld',
"default-src 'self' captcha.tld csp.tld example.com example.net;"
. " img-src 'self' data: captcha.tld csp.tld example.com example.net tile.openstreetmap.org;"
. " img-src 'self' data: captcha.tld csp.tld example.com example.net"
. ' https://tile.openstreetmap.org;'
. " object-src 'none';"
. " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld example.com example.net;"
. " style-src 'self' 'unsafe-inline' captcha.tld csp.tld example.com example.net;"
@ -252,7 +253,7 @@ class HeaderTest extends AbstractTestCase
'PublicKey',
'captcha.tld csp.tld',
"default-src 'self' captcha.tld csp.tld;"
. " img-src 'self' data: captcha.tld csp.tld tile.openstreetmap.org;"
. " img-src 'self' data: captcha.tld csp.tld https://tile.openstreetmap.org;"
. " object-src 'none';"
. " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld;"
. " style-src 'self' 'unsafe-inline' captcha.tld csp.tld;",