Add nonce also to legacy CSP #1920
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Pages that do not use the AppFramework have its CSP inherited from `\OC_Response::addSecurityHeaders`. While those are not many anymore, there are some examples such as the "Help" page. To stay completely backwards-compatible we should also add the nonce to the legacy CSP response. To test that open your browser console and open the help page. Without this you will get a JS error. With this you won't. Signed-off-by: Lukas Reschke <[email protected]>
|
@LukasReschke, thanks for your PR! By analyzing the history of the files in this pull request, we identified @DeepDiver1975, @bartv2 and @bantu to be potential reviewers. |
Signed-off-by: Joas Schilling <[email protected]>
|
Works after fixing Chromium being identified as Chrome to make use of the feature. 👍 |
|
Thanks, @nickvergessen 🚀 |
Current coverage is 57.18% (diff: 0.00%)@@ master #1920 diff @@
==========================================
Files 1078 1078
Lines 61498 61701 +203
Methods 6875 6900 +25
Messages 0 0
Branches 0 0
==========================================
+ Hits 35266 35282 +16
- Misses 26232 26419 +187
Partials 0 0
|
|
yes LGTM! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pages that do not use the AppFramework have its CSP inherited from
\OC_Response::addSecurityHeaders. While those are not many anymore, there are some examples such as the "Help" page.To stay completely backwards-compatible we should also add the nonce to the legacy CSP response.
To test that open your browser console and open the help page. Without this you will get a JS error. With this you won't.
Signed-off-by: Lukas Reschke [email protected]
cc @rullzer