wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use lax CSP when the share is a talk share

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2018-10-22 10:57:55 +02:00
parent f7538fcc82
commit 3febeb6ca7
No known key found for this signature in database
GPG key ID: 7076EA9751AACDDA
1 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
apps/files_sharing/lib/Controller/ShareController.php
View file

@ -35,6 +35,7 @@
namespace OCA\Files_Sharing\Controller;
use OC\Security\CSP\ContentSecurityPolicy;
use OC_Files;
use OC_Util;
use OCA\FederatedFileSharing\FederatedShareProvider;
@ -158,7 +159,16 @@ class ShareController extends AuthPublicShareController {
$event = new GenericEvent(null, $templateParameters);
$this->eventDispatcher->dispatch('OCA\Files_Sharing::loadAdditionalScripts::publicShareAuth', $event);
return new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
$response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
if ($this->share->getSendPasswordByTalk()) {
$csp = new ContentSecurityPolicy();
$csp->addAllowedConnectDomain('*');
$csp->addAllowedMediaDomain('blob:');
$csp->allowEvalScript(true);
$response->setContentSecurityPolicy($csp);
}
return $response;
}
/**
@ -170,7 +180,16 @@ class ShareController extends AuthPublicShareController {
$event = new GenericEvent(null, $templateParameters);
$this->eventDispatcher->dispatch('OCA\Files_Sharing::loadAdditionalScripts::publicShareAuth', $event);
return new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
$response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
if ($this->share->getSendPasswordByTalk()) {
$csp = new ContentSecurityPolicy();
$csp->addAllowedConnectDomain('*');
$csp->addAllowedMediaDomain('blob:');
$csp->allowEvalScript(true);
$response->setContentSecurityPolicy($csp);
}
return $response;
}
protected function verifyPassword(string $password): bool {