Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-08 00:47:04 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Prevent base-uri injection

Browse source
This commit is contained in:
the-djmaze 2022-04-05 14:36:09 +02:00
parent 6a90c62456
commit 852c122e56
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
View file

@ -8,6 +8,7 @@ namespace SnappyMail\HTTP;
class CSP class CSP
{ {
public public
$base = ["'self'"],
$default = ["'self'"], $default = ["'self'"],
// Knockout.js requires unsafe-inline? // Knockout.js requires unsafe-inline?
// Knockout.js requires eval() for observable binding purposes // Knockout.js requires eval() for observable binding purposes
@ -34,6 +35,7 @@ class CSP
function __toString() : string function __toString() : string
{ {
$params = [ $params = [
'base-uri ' . \implode(' ', $this->base),
'default-src ' . \implode(' ', $this->default) 'default-src ' . \implode(' ', $this->default)
]; ];
if ($this->script) { if ($this->script) {