Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-29 20:19:22 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Prevent base-uri injection

Browse source
This commit is contained in:
the-djmaze 2022-04-05 14:36:09 +02:00
parent 6a90c62456
commit 852c122e56
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
View file

@ -8,6 +8,7 @@ namespace SnappyMail\HTTP;
class CSP
{
public
$base = ["'self'"],
$default = ["'self'"],
// Knockout.js requires unsafe-inline?
// Knockout.js requires eval() for observable binding purposes
@ -34,6 +35,7 @@ class CSP
function __toString() : string
{
$params = [
'base-uri ' . \implode(' ', $this->base),
'default-src ' . \implode(' ', $this->default)
];
if ($this->script) {