gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add object-src 'none' to Content Security Policy header

Browse Source 
There’s no need to embed Flash or Java, so just turn off the ability
to embed them for security.

Ref: https://github.com/phpmyadmin/phpmyadmin/issues/12437

Signed-off-by: Ng Yik Phang <ngyikp@gmail.com>
This commit is contained in:
Ng Yik Phang 2017-03-30 22:08:08 +08:00
parent 8643692d75
commit f6b08d3ffb
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/Header.php
View File

@ -546,7 +546,6 @@ class Header
. "script-src 'self' 'unsafe-inline' 'unsafe-eval' "
. $captcha_url
. $GLOBALS['cfg']['CSPAllow'] . ';'
. ";"
. "style-src 'self' 'unsafe-inline' "
. $captcha_url
. $GLOBALS['cfg']['CSPAllow']
@ -556,6 +555,7 @@ class Header
. $map_tile_urls
. $captcha_url
. ";"
. "object-src 'none';"
);
header(
"X-Content-Security-Policy: default-src 'self' "
@ -568,6 +568,7 @@ class Header
. $map_tile_urls
. $captcha_url
. ";"
. "object-src 'none';"
);
header(
"X-WebKit-CSP: default-src 'self' "
@ -586,6 +587,7 @@ class Header
. $map_tile_urls
. $captcha_url
. ";"
. "object-src 'none';"
);
// Re-enable possible disabled XSS filters
// see https://www.owasp.org/index.php/List_of_useful_HTTP_headers