harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'hookableCSP-mr' into 'dev'

Browse Source 
Hookable csp mr

See merge request hubzilla/core!1225
This commit is contained in:
Mario 2018-07-13 09:34:48 +02:00
commit e000d98cc5
1 changed files with 30 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
boot.php
View File

@ -1720,7 +1720,7 @@ function can_view_public_stream() {
if(observer_prohibited(true)) { if(observer_prohibited(true)) {
return false; return false;
} }
if(! (intval(get_config('system','open_pubstream',1)))) { if(! (intval(get_config('system','open_pubstream',1)))) {
if(! get_observer_hash()) { if(! get_observer_hash()) {
return false; return false;
@ -2234,8 +2234,35 @@ function construct_page() {
if(App::get_scheme() === 'https' && App::$config['system']['transport_security_header']) if(App::get_scheme() === 'https' && App::$config['system']['transport_security_header'])
header("Strict-Transport-Security: max-age=31536000"); header("Strict-Transport-Security: max-age=31536000");
if(App::$config['system']['content_security_policy']) if(App::$config['system']['content_security_policy']) {
header("Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"); $cspsettings = Array (
'script-src' => Array ("'self'","'unsafe-inline'","'unsafe-eval'"),
'style-src' => Array ("'self'","'unsafe-inline'")
);
call_hooks('content_security_policy',$cspsettings);
// Legitimate CSP directives (cxref: https://content-security-policy.com/)
$validcspdirectives=Array(
"default-src", "script-src", "style-src",
"img-src", "connect-src", "font-src",
"object-src", "media-src", 'frame-src',
'sandbox', 'report-uri', 'child-src',
'form-action', 'frame-ancestors', 'plugin-types'
);
$cspheader = "Content-Security-Policy:";
foreach ($cspsettings as $cspdirective => $csp) {
if (!in_array($cspdirective,$validcspdirectives)) {
logger("INVALID CSP DIRECTIVE: ".$cspdirective,LOGGER_DEBUG);
continue;
}
$cspsettingsarray=array_unique($cspsettings[$cspdirective]);
$cspsetpolicy = implode(' ',$cspsettingsarray);
if ($cspsetpolicy) {
$cspheader .= " ".$cspdirective." ".$cspsetpolicy.";";
}
}
header($cspheader);
}
if(App::$config['system']['x_security_headers']) { if(App::$config['system']['x_security_headers']) {
header("X-Frame-Options: SAMEORIGIN"); header("X-Frame-Options: SAMEORIGIN");