Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-10-29 00:23:33 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improved handling of Content-Security-Policy

Browse source
This commit is contained in:
the-djmaze 2022-11-07 11:38:36 +01:00
parent 5cd5f77c6f
commit 92d967f1e6
5 changed files with 77 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

50
integrations/nextcloud/snappymail/lib/ContentSecurityPolicy.php Normal file
View file

@ -0,0 +1,50 @@
<?php
namespace OCA\SnappyMail;
class ContentSecurityPolicy extends \OCP\AppFramework\Http\ContentSecurityPolicy {
/** @var bool Whether inline JS snippets are allowed */
protected $inlineScriptAllowed = false;
/** @var bool Whether eval in JS scripts is allowed */
protected $evalScriptAllowed = true;
/** @var bool Whether strict-dynamic should be set */
protected $strictDynamicAllowed = true; // NC24+
/** @var bool Whether inline CSS is allowed */
protected $inlineStyleAllowed = true;
function __construct() {
$CSP = \RainLoop\Api::getCSP();
$this->allowedScriptDomains = \array_unique(\array_merge(
$this->allowedScriptDomains,
$CSP->script
));
$this->allowedScriptDomains = \array_diff($this->allowedScriptDomains, ["'unsafe-inline'", "'unsafe-eval'"]);
if (\method_exists($this, 'useStrictDynamic')) {
$this->allowedScriptDomains = \array_diff($this->allowedScriptDomains, ["'strict-dynamic'"]);
}
$this->allowedImageDomains = \array_unique(\array_merge(
$this->allowedImageDomains,
$CSP->img
));
$this->allowedStyleDomains = \array_unique(\array_merge(
$this->allowedStyleDomains,
$CSP->style
));
$this->allowedStyleDomains = \array_diff($this->allowedStyleDomains, ["'unsafe-inline'"]);
$this->allowedFrameDomains = \array_unique(\array_merge(
$this->allowedFrameDomains,
$CSP->frame
));
$this->reportTo = \array_unique(\array_merge(
$this->reportTo,
$CSP->report_to
));
}
}