From 837ccad57e103704322bb0d0cd4832fbbf1d9d26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 15 May 2012 13:49:56 +0200 Subject: [PATCH] Use double quotes to prevent escaping --- libraries/header_http.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php index 9873c5dbdf..adc8d04473 100644 --- a/libraries/header_http.inc.php +++ b/libraries/header_http.inc.php @@ -22,8 +22,8 @@ $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT'; /* Prevent against ClickJacking by allowing frames only from same origin */ if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) { header('X-Frame-Options: SAMEORIGIN'); - header('X-Content-Security-Policy: allow \'self\'; options inline-script eval-script; frame-ancestors \'self\'; img-src \'self\' data:; script-src \'self\' http://www.phpmyadmin.net'); - header('X-WebKit-CSP: default-src \'self\' \'unsafe-inline\'; img-src \'self\' data:; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' http://www.phpmyadmin.net'); + header("X-Content-Security-Policy: allow 'self'; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:; script-src 'self' http://www.phpmyadmin.net"); + header("X-WebKit-CSP: default-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://www.phpmyadmin.net"); } PMA_no_cache_header(); if (!defined('IS_TRANSFORMATION_WRAPPER')) {