gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Backport Content-Security-Policy from latest release

Browse Source 
This way it will work well on current browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-06-20 09:44:52 +02:00
parent 32875196f9
commit e13f9862ef
1 changed files with 40 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
libraries/Header.class.php
View File

@ -465,6 +465,46 @@ class PMA_Header
'X-Frame-Options: DENY'
);
}
header(
"Content-Security-Policy: default-src 'self' "
. $GLOBALS['cfg']['CSPAllow'] . ';'
. "script-src 'self' 'unsafe-inline' 'unsafe-eval' "
. $GLOBALS['cfg']['CSPAllow'] . ';'
. ";"
. "style-src 'self' 'unsafe-inline' "
. $GLOBALS['cfg']['CSPAllow']
. ";"
. "referrer no-referrer;"
. "img-src 'self' data: "
. $GLOBALS['cfg']['CSPAllow']
. ($https ? "" : $mapTilesUrls)
. ";"
);
header(
"X-Content-Security-Policy: default-src 'self' "
. $GLOBALS['cfg']['CSPAllow'] . ';'
. "options inline-script eval-script;"
. "img-src 'self' data: "
. "referrer no-referrer;"
. $GLOBALS['cfg']['CSPAllow']
. ($https ? "" : $mapTilesUrls)
. ";"
);
header(
"X-WebKit-CSP: default-src 'self' "
. $GLOBALS['cfg']['CSPAllow'] . ';'
. "script-src 'self' "
. $GLOBALS['cfg']['CSPAllow']
. " 'unsafe-inline' 'unsafe-eval';"
. "style-src 'self' 'unsafe-inline' "
. ';'
. "referrer no-referrer;"
. "img-src 'self' data: "
. $GLOBALS['cfg']['CSPAllow']
. ($https ? "" : $mapTilesUrls)
. ";"
);
header(
"X-Content-Security-Policy: default-src 'self' "
. $GLOBALS['cfg']['CSPAllow'] . ';'
@ -475,33 +515,6 @@ class PMA_Header
. ($https ? "" : $mapTilesUrls)
. ";"
);
if (PMA_USR_BROWSER_AGENT == 'SAFARI'
&& PMA_USR_BROWSER_VER < '6.0.0'
) {
header(
"X-WebKit-CSP: allow 'self' "
. $GLOBALS['cfg']['CSPAllow'] . ';'
. "options inline-script eval-script;"
. "img-src 'self' data: "
. $GLOBALS['cfg']['CSPAllow']
. ($https ? "" : $mapTilesUrls)
. ";"
);
} else {
header(
"X-WebKit-CSP: default-src 'self' "
. $GLOBALS['cfg']['CSPAllow'] . ';'
. "script-src 'self' "
. $GLOBALS['cfg']['CSPAllow']
. " 'unsafe-inline' 'unsafe-eval';"
. "style-src 'self' 'unsafe-inline';"
. "referrer no-referrer;"
. "img-src 'self' data: "
. $GLOBALS['cfg']['CSPAllow']
. ($https ? "" : $mapTilesUrls)
. ";"
);
}
}
PMA_noCacheHeader();
if (! defined('IS_TRANSFORMATION_WRAPPER') && ! defined('TESTSUITE')) {