diff options
| author | Morris Jobke <hey@morrisjobke.de> | 2019-03-18 16:17:18 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-03-18 16:17:18 +0100 |
| commit | 458359563bbdfd04f58f0417a4051608016e5e95 (patch) | |
| tree | 3da3baf7d7e3ec9f76472fa6b7973d1c6a5fb441 /lib | |
| parent | 4824d278f9e530d7c5111dc75a1186e7b3ec580e (diff) | |
| parent | 4d8e1f6c679b062a5eaa0b651863890c37f334ce (diff) | |
| download | nextcloud-server-458359563bbdfd04f58f0417a4051608016e5e95.tar.gz nextcloud-server-458359563bbdfd04f58f0417a4051608016e5e95.zip | |
Merge pull request #14724 from nextcloud/enh/nonce_for_iframes
CSP: set nonce for iframes
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php index 3fcef1d0efd..0a77e27d8c0 100644 --- a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php +++ b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php @@ -468,7 +468,11 @@ class EmptyContentSecurityPolicy { } if(!empty($this->allowedFrameDomains)) { - $policy .= 'frame-src ' . implode(' ', $this->allowedFrameDomains); + $policy .= 'frame-src '; + if(is_string($this->useJsNonce)) { + $policy .= '\'nonce-' . base64_encode($this->useJsNonce) . '\' '; + } + $policy .= implode(' ', $this->allowedFrameDomains); $policy .= ';'; } |