Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-10-24 22:25:09 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

CSP block legacy HTML element types such as <object>, <embed>, and <applet> on Raw actions

Browse source
This commit is contained in:
the-djmaze 2026-10-22 18:04:40 +02:00
parent ceb9f68ded
commit 61ebcb6ed4
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
View file

@ -339,7 +339,7 @@ class ServiceActions
$sMethodName = 'Raw'.$sAction;
if (\method_exists($this->oActions, $sMethodName)) {
\header('X-Raw-Action: '.$sMethodName);
\header('Content-Security-Policy: script-src \'none\'; child-src \'none\'');
\header('Content-Security-Policy: script-src \'none\'; child-src \'none\'; object-src \'none\'');
$sRawError = '';
$this->oActions->SetActionParams(array(