Merge remote-tracking branch 'origin/master'

doc/config.rst

@@ -1941,6 +1941,18 @@ Web server settings
     Limit for length of :term:`URL` in links.  When length would be above this
     limit, it is replaced by form with button. This is required as some web
     servers (:term:`IIS`) have problems with long :term:`URL` .
+ 
+.. config:option:: $cfg['CSPAllow']
+
+    :type: string
+    :default: ``''``
+
+    Additional string to include in allowed script sources in Content Security
+    Policy header.
+
+    This can be useful when you want to include some external javascript files
+    in :file:`config.footer.inc.php` or :file:`config.header.inc.php`, which
+    would be normally not allowed by Content Security Policy.
 
 .. config:option:: $cfg['DisableMultiTableMaintenance']
 

libraries/Header.class.php

@@ -451,7 +451,8 @@ class PMA_Header
         $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
         if (! defined('TESTSUITE')) {
             header(
-                "X-Content-Security-Policy: default-src 'self';"
+                "X-Content-Security-Policy: default-src 'self' "
+                . $GLOBALS['cfg']['CSPAllow'] . ';'
                 . "options inline-script eval-script;"
                 . "img-src 'self' data:"
                 . ($https ? "" : $mapTilesUrls)
@@ -461,7 +462,8 @@ class PMA_Header
                 && PMA_USR_BROWSER_VER < '6.0.0'
             ) {
                 header(
-                    "X-WebKit-CSP: allow 'self';"
+                    "X-WebKit-CSP: allow 'self' "
+                    . $GLOBALS['cfg']['CSPAllow'] . ';'
                     . "options inline-script eval-script;"
                     . "img-src 'self' data:"
                     . ($https ? "" : $mapTilesUrls)
@@ -469,8 +471,11 @@ class PMA_Header
                 );
             } else {
                 header(
-                    "X-WebKit-CSP: default-src 'self';"
-                    . "script-src 'self' 'unsafe-inline' 'unsafe-eval';"
+                    "X-WebKit-CSP: default-src 'self' "
+                    . $GLOBALS['cfg']['CSPAllow'] . ';'
+                    . "script-src 'self' "
+                    . $GLOBALS['cfg']['CSPAllow']
+                    . " 'unsafe-inline' 'unsafe-eval';"
                     . "style-src 'self' 'unsafe-inline';"
                     . "img-src 'self' data:"
                     . ($https ? "" : $mapTilesUrls)

libraries/config.default.php

@@ -2745,6 +2745,11 @@ $cfg['CheckConfigurationPermissions'] = true;
  */
 $cfg['LinkLengthLimit'] = 1000;
 
+/**
+ * Additional string to allow in CSP headers.
+ */
+ $cfg['CSPAllow'] = '';
+
 /**
  * Disable the table maintenance mass operations, like optimizing or
  * repairing the selected tables of a database. An accidental execution