DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2025-02-21 03:15:45 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #14357 from snipe/fixes/stricter_csp_rules

Browse source 
Removed unsafe-inline and unsafe-eval
This commit is contained in:
snipe 2024-03-01 11:48:51 +00:00 committed by GitHub
parent bc5c559413 93e69ab0c6
commit 5b9b21a7d1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/Http/Middleware/SecurityHeaders.php
View file

@ -83,8 +83,8 @@ class SecurityHeaders
if ((config('app.debug') != 'true') && (config('app.enable_csp') == 'true')) {
$csp_policy[] = "default-src 'self'";
$csp_policy[] = "style-src 'self' 'unsafe-inline'";
$csp_policy[] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'";
$csp_policy[] = "style-src 'self'";
$csp_policy[] = "script-src 'self'";
$csp_policy[] = "connect-src 'self'";
$csp_policy[] = "object-src 'none'";
$csp_policy[] = "font-src 'self' data:";