diff --git a/rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php b/rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php index fd358be34..0fccfd103 100644 --- a/rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php +++ b/rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php @@ -179,7 +179,7 @@ class Application extends \RainLoop\Config\AbstractConfig 'hide_x_mailer_header' => array(true), 'admin_panel_host' => array(''), 'admin_panel_key' => array('admin'), - 'content_security_policy' => array(APP_DEFAULT_CSP), + 'content_security_policy' => array(''), 'core_install_access_domain' => array('') ), @@ -388,7 +388,7 @@ Enables caching in the system'), 'fast_cache_memcache_port' => array(11211), 'fast_cache_redis_host' => array('127.0.0.1'), 'fast_cache_redis_port' => array(6379), - 'use_local_proxy_for_external_images' => array(false), + 'use_local_proxy_for_external_images' => array(true), 'detect_image_exif_orientation' => array(true), 'cookie_default_path' => array(''), 'cookie_default_secure' => array(false), diff --git a/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php b/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php index 9493df7c2..431405916 100644 --- a/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php +++ b/rainloop/v/0.0.0/app/libraries/RainLoop/Service.php @@ -42,6 +42,9 @@ class Service \header('X-Content-Type-Options: nosniff'); $sContentSecurityPolicy = \trim($this->oActions->Config()->Get('security', 'content_security_policy', '')) ?: APP_DEFAULT_CSP; + if ($this->oActions->Config()->Get('security', 'use_local_proxy_for_external_images', '')) { + $sContentSecurityPolicy = preg_replace('/(img-src[^;]+)\\shttps:(\\s|;|$)/D', '$1$2', $sContentSecurityPolicy); + } \header('Content-Security-Policy: '.$sContentSecurityPolicy, true); $sXFrameOptionsHeader = \trim($this->oActions->Config()->Get('security', 'x_frame_options_header', '')) ?: 'DENY';