wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #14724 from nextcloud/enh/nonce_for_iframes

Browse source 
CSP: set nonce for iframes
This commit is contained in:
Morris Jobke 2019-03-18 16:17:18 +01:00 committed by GitHub
commit 458359563b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php
View file

@ -468,7 +468,11 @@ class EmptyContentSecurityPolicy {
}
if(!empty($this->allowedFrameDomains)) {
$policy .= 'frame-src ' . implode(' ', $this->allowedFrameDomains);
$policy .= 'frame-src ';
if(is_string($this->useJsNonce)) {
$policy .= '\'nonce-' . base64_encode($this->useJsNonce) . '\' ';
}
$policy .= implode(' ', $this->allowedFrameDomains);
$policy .= ';';
}