From 0dc093b35b05ee178542d6175f890e76f821b461 Mon Sep 17 00:00:00 2001 From: djmaze Date: Thu, 15 Oct 2020 13:01:14 +0200 Subject: [PATCH] Change for insecure images over http See https://github.com/the-djmaze/snappymail/issues/16#issuecomment-707962963 --- rainloop/v/0.0.0/app/libraries/RainLoop/Service.php | 1 + rainloop/v/0.0.0/include.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php b/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php index 431405916..f4e480ef8 100644 --- a/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php +++ b/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php @@ -44,6 +44,7 @@ class Service $sContentSecurityPolicy = \trim($this->oActions->Config()->Get('security', 'content_security_policy', '')) ?: APP_DEFAULT_CSP; if ($this->oActions->Config()->Get('security', 'use_local_proxy_for_external_images', '')) { $sContentSecurityPolicy = preg_replace('/(img-src[^;]+)\\shttps:(\\s|;|$)/D', '$1$2', $sContentSecurityPolicy); + $sContentSecurityPolicy = preg_replace('/(img-src[^;]+)\\shttp:(\\s|;|$)/D', '$1$2', $sContentSecurityPolicy); } \header('Content-Security-Policy: '.$sContentSecurityPolicy, true); diff --git a/rainloop/v/0.0.0/include.php b/rainloop/v/0.0.0/include.php index 8b3defa99..9c694dd2d 100644 --- a/rainloop/v/0.0.0/include.php +++ b/rainloop/v/0.0.0/include.php @@ -23,7 +23,7 @@ define('APP_USE_APC_CACHE', true); // "img-src https:" is allowed due to remote images in e-mails - define('APP_DEFAULT_CSP', "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'"); + define('APP_DEFAULT_CSP', "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https: http:; style-src 'self' 'unsafe-inline'"); date_default_timezone_set('UTC');