DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2024-09-22 08:47:35 -07:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Merge branch 'develop'

Browse source
This commit is contained in:
snipe 2017-10-02 13:31:08 -07:00
parent e389f67629 7a27fda083
commit 0b968e1d6b
4 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.env.example
View file

@ -69,7 +69,7 @@ SECURE_COOKIES=false
# OPTIONAL: SECURITY HEADER SETTINGS # OPTIONAL: SECURITY HEADER SETTINGS
# -------------------------------------------- # --------------------------------------------
REFERRER_POLICY=strict-origin REFERRER_POLICY=strict-origin
DISABLE_CSP=false ENABLE_CSP=false
# -------------------------------------------- # --------------------------------------------

4
app/Http/Middleware/ContentSecurityPolicyHeader.php
View file

@ -14,14 +14,14 @@ class ContentSecurityPolicyHeader
*/ */
public function handle($request, Closure $next) public function handle($request, Closure $next)
{ {
if ((config('app.debug')=='true') || (config('app.disable_csp')=='true')) { if ((config('app.debug')=='true') || (config('app.enable_csp')!='true')) {
$response = $next($request); $response = $next($request);
return $response; return $response;
} }
$policy[] = "default-src 'self'"; $policy[] = "default-src 'self'";
$policy[] = "style-src 'self' 'unsafe-inline' oss.maxcdn.com"; $policy[] = "style-src 'self' 'unsafe-inline' oss.maxcdn.com";
$policy[] = "script-src 'self' oss.mafxcdn.com cdnjs.cloudflare.com 'nonce-".csrf_token()."'"; $policy[] = "script-src 'self' 'unsafe-inline' oss.mafxcdn.com cdnjs.cloudflare.com 'nonce-".csrf_token()."'";
$policy[] = "connect-src 'self'"; $policy[] = "connect-src 'self'";
$policy[] = "object-src 'none'"; $policy[] = "object-src 'none'";
$policy[] = "font-src 'self' data:"; $policy[] = "font-src 'self' data:";

2
config/app.php
View file

@ -183,7 +183,7 @@ return [
| |
*/ */
'disable_csp' => env('DISABLE_CSP', false), 'enable_csp' => env('ENABLE_CSP', false),

4
resources/views/layouts/default.blade.php
View file

@ -84,8 +84,8 @@
<script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js" integrity="sha384-ZoaMbDF+4LeFxg6WdScQ9nnR1QC2MIRxA1O9KWEXQwns1G8UNyIEZIQidzb0T1fo" crossorigin="anonymous"></script> <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js" integrity="sha384-ZoaMbDF+4LeFxg6WdScQ9nnR1QC2MIRxA1O9KWEXQwns1G8UNyIEZIQidzb0T1fo" crossorigin="anonymous"></script>
@else @else
<script src="{{ url(asset('js/html5shiv.js')) }}"></script> <script src="{{ url(asset('js/html5shiv.js')) }}" nonce="{{ csrf_token() }}"></script>
<script src="{{ url(asset('js/respond.js')) }}"></script> <script src="{{ url(asset('js/respond.js')) }}" nonce="{{ csrf_token() }}"></script>
@endif @endif
<![endif]--> <![endif]-->
</head> </head>