diff options
| author | Roeland Jago Douma <rullzer@users.noreply.github.com> | 2020-02-28 09:46:09 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-02-28 09:46:09 +0100 |
| commit | dd5a4c960399e1b13c5f5f78e36439dd36e2e0a4 (patch) | |
| tree | 619ad5e28d0d00fefd20630f7bc2e69e60fb549b /core | |
| parent | e231dd8b34050f48883c225d0c57df2c6368084d (diff) | |
| parent | 6eb466776b642c5689f6f4c216eddf0d302566c0 (diff) | |
| download | nextcloud-server-dd5a4c960399e1b13c5f5f78e36439dd36e2e0a4.tar.gz nextcloud-server-dd5a4c960399e1b13c5f5f78e36439dd36e2e0a4.zip | |
Merge pull request #19666 from nextcloud/bug/19416/referrer-policy-fallback
Don't show referrer policy warning if fallback policy set.
Diffstat (limited to 'core')
| -rw-r--r-- | core/js/setupchecks.js | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/core/js/setupchecks.js b/core/js/setupchecks.js index 1e50644aa27..95fb4f6b213 100644 --- a/core/js/setupchecks.js +++ b/core/js/setupchecks.js @@ -573,12 +573,8 @@ }); } - if (!xhr.getResponseHeader('Referrer-Policy') || - (xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'no-referrer' && - xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'no-referrer-when-downgrade' && - xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'strict-origin' && - xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'strict-origin-when-cross-origin' && - xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'same-origin')) { + const referrerPolicy = xhr.getResponseHeader('Referrer-Policy') + if (referrerPolicy === null || !/(no-referrer(-when-downgrade)?|strict-origin(-when-cross-origin)?|same-origin)(,|$)/.test(referrerPolicy)) { messages.push({ msg: t('core', 'The "{header}" HTTP header is not set to "{val1}", "{val2}", "{val3}", "{val4}" or "{val5}". This can leak referer information. See the <a target="_blank" rel="noreferrer noopener" href="{link}">W3C Recommendation ↗</a>.', { @@ -591,7 +587,7 @@ link: 'https://www.w3.org/TR/referrer-policy/' }), type: OC.SetupChecks.MESSAGE_TYPE_INFO - }); + }) } } else { messages.push({ |