harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

extra security headers, revert or fix if functionality is blocked

Browse Source
This commit is contained in:
redmatrix 2016-01-07 12:47:46 -08:00
parent 761afd029d
commit 100412267a
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
boot.php
View File

@ -874,6 +874,11 @@ class App {
}
}
function get_scheme() {
return $this->scheme;
}
function get_hostname() {
return $this->hostname;
}
@ -2121,6 +2126,16 @@ function construct_page(&$a) {
$profile = $a->profile;
header("Content-type: text/html; charset=utf-8");
if($a->get_scheme() === 'https')
header("Strict-Transport-Security: max-age=31536000");
header("Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'");
if($a->config['system']['x_security_headers']) {
header("X-Frame-Options: SAMEORIGIN");
header("X-Xss-Protection: 1; mode=block;");
header("X-Content-Type-Options: nosniff");
}
require_once(theme_include(
((x($a->page, 'template')) ? $a->page['template'] : 'default' ) . '.php' )

2
version.inc
View File

@ -1 +1 @@
2016-01-06.1270H
2016-01-07.1271H