diff options
| author | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-08-13 17:53:30 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-08-13 17:53:30 +0200 |
| commit | 3e409fd34208afb69b270076e1f503c10101650a (patch) | |
| tree | e3bb7de6441e907c5c9aa4c7013f742ce7804fdd /core | |
| parent | bb706998a97c832b50c58e73a2cd92b0ecc4109c (diff) | |
| parent | 2916e5df7e08fc588e752beaf486d907112a34ee (diff) | |
| download | nextcloud-server-3e409fd34208afb69b270076e1f503c10101650a.tar.gz nextcloud-server-3e409fd34208afb69b270076e1f503c10101650a.zip | |
Merge pull request #43573 from nextcloud/HolgerHees-fix-csp-nonce-handling
Fix for ignored `CSP_NONCE` in ContentSecurity Header
Diffstat (limited to 'core')
| -rw-r--r-- | core/templates/layout.base.php | 1 | ||||
| -rw-r--r-- | core/templates/layout.guest.php | 1 | ||||
| -rw-r--r-- | core/templates/layout.initial-state.php | 6 | ||||
| -rw-r--r-- | core/templates/layout.public.php | 1 | ||||
| -rw-r--r-- | core/templates/layout.user.php | 1 |
5 files changed, 7 insertions, 3 deletions
diff --git a/core/templates/layout.base.php b/core/templates/layout.base.php index eb88d62632e..e74cd4b8cd2 100644 --- a/core/templates/layout.base.php +++ b/core/templates/layout.base.php @@ -14,6 +14,7 @@ </title> <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0"> <meta name="theme-color" content="<?php p($theme->getColorPrimary()); ?>"> + <meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>"> <link rel="icon" href="<?php print_unescaped(image_path('core', 'favicon.ico')); /* IE11+ supports png */ ?>"> <link rel="apple-touch-icon" href="<?php print_unescaped(image_path('core', 'favicon-touch.png')); ?>"> <link rel="mask-icon" sizes="any" href="<?php print_unescaped(image_path('core', 'favicon-mask.svg')); ?>" color="<?php p($theme->getColorPrimary()); ?>"> diff --git a/core/templates/layout.guest.php b/core/templates/layout.guest.php index be0c36d6c53..03682a24193 100644 --- a/core/templates/layout.guest.php +++ b/core/templates/layout.guest.php @@ -19,6 +19,7 @@ p($theme->getTitle()); ?> </title> + <meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>"> <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0"> <?php if ($theme->getiTunesAppId() !== '') { ?> <meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>"> diff --git a/core/templates/layout.initial-state.php b/core/templates/layout.initial-state.php index 23c9be1a9c4..f2387990b12 100644 --- a/core/templates/layout.initial-state.php +++ b/core/templates/layout.initial-state.php @@ -5,7 +5,7 @@ */ ?> <div id="initial-state-container" style="display: none;"> - <?php foreach ($_['initialStates'] as $app => $initialState) { ?> - <input type="hidden" id="initial-state-<?php p($app); ?>" value="<?php p(base64_encode($initialState)); ?>"> - <?php }?> + <?php foreach ($_['initialStates'] as $app => $initialState) { ?> + <input type="hidden" id="initial-state-<?php p($app); ?>" value="<?php p(base64_encode($initialState)); ?>"> + <?php }?> </div> diff --git a/core/templates/layout.public.php b/core/templates/layout.public.php index b228801190c..90aefe0b8a8 100644 --- a/core/templates/layout.public.php +++ b/core/templates/layout.public.php @@ -14,6 +14,7 @@ p($theme->getTitle()); ?> </title> + <meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>"> <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0"> <?php if ($theme->getiTunesAppId() !== '') { ?> <meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>"> diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php index 475d1b89a0f..3293fc0acd7 100644 --- a/core/templates/layout.user.php +++ b/core/templates/layout.user.php @@ -29,6 +29,7 @@ p(!empty($_['application']) ? $_['application'].' - ' : ''); p($theme->getTitle()); ?> </title> + <meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>"> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <?php if ($theme->getiTunesAppId() !== '') { ?> |