From f6b08d3ffbdf0cda5fdaa1489c3d4b2bb0ef378e Mon Sep 17 00:00:00 2001 From: Ng Yik Phang Date: Thu, 30 Mar 2017 22:08:08 +0800 Subject: [PATCH] Add `object-src 'none'` to Content Security Policy header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There’s no need to embed Flash or Java, so just turn off the ability to embed them for security. Ref: https://github.com/phpmyadmin/phpmyadmin/issues/12437 Signed-off-by: Ng Yik Phang --- libraries/Header.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libraries/Header.php b/libraries/Header.php index 03ac4004fa..a9deddc5f4 100644 --- a/libraries/Header.php +++ b/libraries/Header.php @@ -546,7 +546,6 @@ class Header . "script-src 'self' 'unsafe-inline' 'unsafe-eval' " . $captcha_url . $GLOBALS['cfg']['CSPAllow'] . ';' - . ";" . "style-src 'self' 'unsafe-inline' " . $captcha_url . $GLOBALS['cfg']['CSPAllow'] @@ -556,6 +555,7 @@ class Header . $map_tile_urls . $captcha_url . ";" + . "object-src 'none';" ); header( "X-Content-Security-Policy: default-src 'self' " @@ -568,6 +568,7 @@ class Header . $map_tile_urls . $captcha_url . ";" + . "object-src 'none';" ); header( "X-WebKit-CSP: default-src 'self' " @@ -586,6 +587,7 @@ class Header . $map_tile_urls . $captcha_url . ";" + . "object-src 'none';" ); // Re-enable possible disabled XSS filters // see https://www.owasp.org/index.php/List_of_useful_HTTP_headers