1 files changed, 33 insertions, 0 deletions
diff --git a/lib/public/AppFramework/Http/StrictInlineContentSecurityPolicy.php b/lib/public/AppFramework/Http/StrictInlineContentSecurityPolicy.php
new file mode 100644
index 00000000000..e80d37c74cf
--- /dev/null
+++ b/lib/public/AppFramework/Http/StrictInlineContentSecurityPolicy.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\AppFramework\Http;
+
+/**
+ * Class StrictInlineContentSecurityPolicy is a simple helper which allows applications to
+ * modify the Content-Security-Policy sent by Nextcloud. Per default only JavaScript,
+ * stylesheets, images, fonts, media and connections from the same domain
+ * ('self') are allowed.
+ *
+ * Even if a value gets modified above defaults will still get appended. Please
+ * note that Nextcloud ships already with sensible defaults and those policies
+ * should require no modification at all for most use-cases.
+ *
+ * This is a temp helper class from the default ContentSecurityPolicy to allow slow
+ * migration to a stricter CSP. This does not allow inline styles.
+ *
+ * @since 14.0.0
+ * @deprecated 17.0.0
+ */
+class StrictInlineContentSecurityPolicy extends ContentSecurityPolicy {
+	/**
+	 * @since 14.0.0
+	 */
+	public function __construct() {
+		$this->inlineStyleAllowed = false;
+	}
+}