Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-29 03:59:21 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Change for insecure images over http

Browse source 
See https://github.com/the-djmaze/snappymail/issues/16#issuecomment-707962963
This commit is contained in:
djmaze 2020-10-15 13:01:14 +02:00
parent 0528bcf911
commit 0dc093b35b
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
rainloop/v/0.0.0/app/libraries/RainLoop/Service.php
View file

@ -44,6 +44,7 @@ class Service
$sContentSecurityPolicy = \trim($this->oActions->Config()->Get('security', 'content_security_policy', '')) ?: APP_DEFAULT_CSP;
if ($this->oActions->Config()->Get('security', 'use_local_proxy_for_external_images', '')) {
$sContentSecurityPolicy = preg_replace('/(img-src[^;]+)\\shttps:(\\s|;|$)/D', '$1$2', $sContentSecurityPolicy);
$sContentSecurityPolicy = preg_replace('/(img-src[^;]+)\\shttp:(\\s|;|$)/D', '$1$2', $sContentSecurityPolicy);
}
\header('Content-Security-Policy: '.$sContentSecurityPolicy, true);

2
rainloop/v/0.0.0/include.php
View file

@ -23,7 +23,7 @@
define('APP_USE_APC_CACHE', true);
// "img-src https:" is allowed due to remote images in e-mails
define('APP_DEFAULT_CSP', "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'");
define('APP_DEFAULT_CSP', "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https: http:; style-src 'self' 'unsafe-inline'");
date_default_timezone_set('UTC');