diff options
| author | Roeland Jago Douma <rullzer@users.noreply.github.com> | 2016-10-26 16:41:34 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-10-26 16:41:34 +0200 |
| commit | b98dfaccd96fb9b0da13bc59f55ed9b61cbbd528 (patch) | |
| tree | 3d7ce4fe873d345912aab0e2c999000ff93494ae /lib | |
| parent | cd12e2d20aa5656cbc51a17684c897ae75f78e9f (diff) | |
| parent | c20ab0049f91cbace09cbec3ce35e9b41515f179 (diff) | |
| download | nextcloud-server-b98dfaccd96fb9b0da13bc59f55ed9b61cbbd528.tar.gz nextcloud-server-b98dfaccd96fb9b0da13bc59f55ed9b61cbbd528.zip | |
Merge pull request #1920 from nextcloud/legacy-pages-should-also-receive-the-nonce
Add nonce also to legacy CSP
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/private/AppFramework/Http/Request.php | 2 | ||||
| -rw-r--r-- | lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php | 4 | ||||
| -rw-r--r-- | lib/private/legacy/response.php | 2 |
3 files changed, 4 insertions, 4 deletions
diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php index ba8a48381bd..c7a3be163fe 100644 --- a/lib/private/AppFramework/Http/Request.php +++ b/lib/private/AppFramework/Http/Request.php @@ -61,7 +61,7 @@ class Request implements \ArrayAccess, \Countable, IRequest { // Firefox User Agent from https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference const USER_AGENT_FIREFOX = '/^Mozilla\/5\.0 \([^)]+\) Gecko\/[0-9.]+ Firefox\/[0-9.]+$/'; // Chrome User Agent from https://developer.chrome.com/multidevice/user-agent - const USER_AGENT_CHROME = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+$/'; + const USER_AGENT_CHROME = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\)( Ubuntu Chromium\/[0-9.]+|) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+$/'; // Safari User Agent from http://www.useragentstring.com/pages/Safari/ const USER_AGENT_SAFARI = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Version\/[0-9.]+ Safari\/[0-9.A-Z]+$/'; // Android Chrome user agent: https://developers.google.com/chrome/mobile/docs/user-agent diff --git a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php index e6a39b12a42..284700566d6 100644 --- a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php +++ b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php @@ -21,6 +21,7 @@ namespace OC\Security\CSP; +use OC\AppFramework\Http\Request; use OC\Security\CSRF\CsrfTokenManager; use OCP\IRequest; @@ -65,8 +66,7 @@ class ContentSecurityPolicyNonceManager { */ public function browserSupportsCspV3() { $browserWhitelist = [ - // Chrome 40+ - '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[4-9][0-9].[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+$/', + Request::USER_AGENT_CHROME, // Firefox 45+ '/^Mozilla\/5\.0 \([^)]+\) Gecko\/[0-9.]+ Firefox\/(4[5-9]|[5-9][0-9])\.[0-9.]+$/', // Safari 10+ diff --git a/lib/private/legacy/response.php b/lib/private/legacy/response.php index 88725d5e30b..69c84e2df68 100644 --- a/lib/private/legacy/response.php +++ b/lib/private/legacy/response.php @@ -247,7 +247,7 @@ class OC_Response { * @see \OCP\AppFramework\Http\Response::getHeaders */ $policy = 'default-src \'self\'; ' - . 'script-src \'self\' \'unsafe-eval\'; ' + . 'script-src \'self\' \'unsafe-eval\' \'nonce-'.\OC::$server->getContentSecurityPolicyNonceManager()->getNonce().'\'; ' . 'style-src \'self\' \'unsafe-inline\'; ' . 'frame-src *; ' . 'img-src * data: blob:; ' |