diff options
| author | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-08-01 23:06:55 +0200 |
|---|---|---|
| committer | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-08-13 10:32:44 +0200 |
| commit | 2916e5df7e08fc588e752beaf486d907112a34ee (patch) | |
| tree | 968c83adcd9a70717bda5d1d1a5e06f23a158097 /core/templates/layout.initial-state.php | |
| parent | 009761be58c4485f29a8d3382e51fb4e1bfbeec4 (diff) | |
| download | nextcloud-server-2916e5df7e08fc588e752beaf486d907112a34ee.tar.gz nextcloud-server-2916e5df7e08fc588e752beaf486d907112a34ee.zip | |
feat: Provide CSP nonce as `<meta>` element
This way we use the CSP nonce for dynamically loaded scripts.
Important to notice: The CSP nonce must NOT be injected in `content` as
this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors).
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
Diffstat (limited to 'core/templates/layout.initial-state.php')
| -rw-r--r-- | core/templates/layout.initial-state.php | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/core/templates/layout.initial-state.php b/core/templates/layout.initial-state.php index 23c9be1a9c4..f2387990b12 100644 --- a/core/templates/layout.initial-state.php +++ b/core/templates/layout.initial-state.php @@ -5,7 +5,7 @@ */ ?> <div id="initial-state-container" style="display: none;"> - <?php foreach ($_['initialStates'] as $app => $initialState) { ?> - <input type="hidden" id="initial-state-<?php p($app); ?>" value="<?php p(base64_encode($initialState)); ?>"> - <?php }?> + <?php foreach ($_['initialStates'] as $app => $initialState) { ?> + <input type="hidden" id="initial-state-<?php p($app); ?>" value="<?php p(base64_encode($initialState)); ?>"> + <?php }?> </div> |