From 76be8591961649ac4045b34df247494170d07aeb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maximilian=20Kr=C3=B6g?= Date: Sat, 7 Mar 2026 23:50:56 +0100 Subject: [PATCH] Restrict map tile url to https protocol MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maximilian Krög --- src/Header.php | 2 +- tests/unit/HeaderTest.php | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/Header.php b/src/Header.php index 929b944144..034b41edc7 100644 --- a/src/Header.php +++ b/src/Header.php @@ -419,7 +419,7 @@ class Header /** Get the Content-Security-Policy header */ private function getCspHeader(): string { - $mapTileUrl = ' tile.openstreetmap.org'; + $mapTileUrl = ' https://tile.openstreetmap.org'; $cspAllow = $this->config->config->CSPAllow === '' ? '' : ' ' . $this->config->config->CSPAllow; $captchaUrl = $this->config->config->CaptchaLoginPrivateKey === '' || diff --git a/tests/unit/HeaderTest.php b/tests/unit/HeaderTest.php index da19212ce9..98e9a5fa2d 100644 --- a/tests/unit/HeaderTest.php +++ b/tests/unit/HeaderTest.php @@ -226,7 +226,7 @@ class HeaderTest extends AbstractTestCase '', '', "default-src 'self';" - . " img-src 'self' data: tile.openstreetmap.org;" + . " img-src 'self' data: https://tile.openstreetmap.org;" . " object-src 'none';" . " script-src 'self' 'unsafe-inline' 'unsafe-eval';" . " style-src 'self' 'unsafe-inline';" @@ -239,7 +239,8 @@ class HeaderTest extends AbstractTestCase 'PublicKey', 'captcha.tld csp.tld', "default-src 'self' captcha.tld csp.tld example.com example.net;" - . " img-src 'self' data: captcha.tld csp.tld example.com example.net tile.openstreetmap.org;" + . " img-src 'self' data: captcha.tld csp.tld example.com example.net" + . ' https://tile.openstreetmap.org;' . " object-src 'none';" . " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld example.com example.net;" . " style-src 'self' 'unsafe-inline' captcha.tld csp.tld example.com example.net;" @@ -252,7 +253,7 @@ class HeaderTest extends AbstractTestCase 'PublicKey', 'captcha.tld csp.tld', "default-src 'self' captcha.tld csp.tld;" - . " img-src 'self' data: captcha.tld csp.tld tile.openstreetmap.org;" + . " img-src 'self' data: captcha.tld csp.tld https://tile.openstreetmap.org;" . " object-src 'none';" . " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld;" . " style-src 'self' 'unsafe-inline' captcha.tld csp.tld;",