From 8c8099e2f7c994f3a4822c5ef804b18fbe357cd6 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Tue, 1 Jan 2013 08:34:16 -0500 Subject: [PATCH] - for WebKit-based browsers like Chrome, use the new CSP syntax ( see X-WebKit-CSP) - I believe we no longer need to mention phpmyadmin.net in the allowed lists, due to our fetching of JSON content instead of a js --- libraries/header_http.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php index e8126456f3..083e5d626e 100644 --- a/libraries/header_http.inc.php +++ b/libraries/header_http.inc.php @@ -22,8 +22,8 @@ $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT'; /* Prevent against ClickJacking by allowing frames only from same origin */ if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) { header('X-Frame-Options: SAMEORIGIN'); - header("X-Content-Security-Policy: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:"); - header("X-WebKit-CSP: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script"); + header("X-Content-Security-Policy: allow 'self' ; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:"); + header("X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"); } PMA_no_cache_header(); if (!defined('IS_TRANSFORMATION_WRAPPER')) {