Uh oh!
There was an error while loading. Please reload this page.
Add nonce also to legacy CSP - #1920
Merged
Merged
Conversation
Pages that do not use the AppFramework have its CSP inherited from `\OC_Response::addSecurityHeaders`. While those are not many anymore, there are some examples such as the "Help" page. To stay completely backwards-compatible we should also add the nonce to the legacy CSP response. To test that open your browser console and open the help page. Without this you will get a JS error. With this you won't. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
mention-bot
commented
Oct 26, 2016
@LukasReschke, thanks for your PR! By analyzing the history of the files in this pull request, we identified @DeepDiver1975, @bartv2 and @bantu to be potential reviewers. |
Signed-off-by: Joas Schilling <coding@schilljs.com>
Member
Works after fixing Chromium being identified as Chrome to make use of the feature. 👍 |
LukasReschke
commented
Oct 26, 2016
MemberAuthor
Thanks, @nickvergessen 🚀 |
codecov-io
commented
Oct 26, 2016
Current coverage is 57.18% (diff: 0.00%)@@ master #1920 diff @@
==========================================
Files 1078 1078 Lines 61498 61701 +203 Methods 6875 6900 +25 Messages 0 0 Branches 0 0 ==========================================
+ Hits 35266 35282 +16 - Misses 26232 26419 +187
Partials 0 0
|
rullzer
commented
Oct 26, 2016
Member
yes LGTM! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pages that do not use the AppFramework have its CSP inherited from
\OC_Response::addSecurityHeaders. While those are not many anymore, there are some examples such as the "Help" page.To stay completely backwards-compatible we should also add the nonce to the legacy CSP response.
To test that open your browser console and open the help page. Without this you will get a JS error. With this you won't.
Signed-off-by: Lukas Reschke lukas@statuscode.ch
cc @rullzer