diff options
| author | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-08-01 23:06:23 +0200 |
|---|---|---|
| committer | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-08-13 09:52:33 +0200 |
| commit | 86f01a3358df1c5b9c8c8f78ffa46f2cf234b0e3 (patch) | |
| tree | 4669313c975d3a84dfac0839595e8630faa2c732 /lib/public | |
| parent | 73397cd75998c70ccbb5d2cfa87465b88ba23152 (diff) | |
| download | nextcloud-server-86f01a3358df1c5b9c8c8f78ffa46f2cf234b0e3.tar.gz nextcloud-server-86f01a3358df1c5b9c8c8f78ffa46f2cf234b0e3.zip | |
fix: Make sure CSP nonce is not double base64 encoded
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
Diffstat (limited to 'lib/public')
| -rw-r--r-- | lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php index 5b4cf7eab8b..7772f2f3f3c 100644 --- a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php +++ b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php @@ -89,7 +89,7 @@ class EmptyContentSecurityPolicy { } /** - * Use the according JS nonce + * Use the according base64 encoded JS nonce * This method is only for CSPMiddleware, custom values are ignored in mergePolicies of ContentSecurityPolicyManager * * @param string $nonce @@ -448,7 +448,7 @@ class EmptyContentSecurityPolicy { if ($this->strictDynamicAllowed) { $scriptSrc .= '\'strict-dynamic\' '; } - $scriptSrc .= '\'nonce-'.base64_encode($this->jsNonce).'\''; + $scriptSrc .= '\'nonce-'.$this->jsNonce.'\''; $allowedScriptDomains = array_flip($this->allowedScriptDomains); unset($allowedScriptDomains['\'self\'']); $this->allowedScriptDomains = array_flip($allowedScriptDomains); |