Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-07 16:37:02 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

CSP 'unsafe-eval' required for Knockout.js, see issue #103

Browse source
This commit is contained in:
djmaze 2021-07-28 14:41:43 +02:00
parent a3d2b560d0
commit e0106a6e52
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
snappymail/v/0.0.0/app/libraries/RainLoop/Service.php
View file

@ -207,7 +207,9 @@ class Service
if ($sScriptNonce) { if ($sScriptNonce) {
$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", "\$1'nonce-{$sScriptNonce}'", $sContentSecurityPolicy); $sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", "\$1'nonce-{$sScriptNonce}'", $sContentSecurityPolicy);
} }
$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", '', $sContentSecurityPolicy); $sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", '$1', $sContentSecurityPolicy);
// Knockout.js requires eval() for observable binding purposes
//$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-eval'/", '$1', $sContentSecurityPolicy);
} }
\header('Content-Security-Policy: '.$sContentSecurityPolicy, true); \header('Content-Security-Policy: '.$sContentSecurityPolicy, true);
} }