From dfe9e3fb2e063a0cf4ab4849a4329f05cb6255b7 Mon Sep 17 00:00:00 2001 From: Daniel Calviño Sánchez Date: Wed, 10 Apr 2019 16:46:19 +0200 Subject: Do not allow JavaScript "eval" in the public share auth page with Talk MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Talk no longer uses JavaScript "eval", so the Content Security Policy can now be configured to prevent its use in the public share authentication page when the password is protected by Talk. Signed-off-by: Daniel Calviño Sánchez --- apps/files_sharing/lib/Controller/ShareController.php | 2 -- 1 file changed, 2 deletions(-) (limited to 'apps/files_sharing') diff --git a/apps/files_sharing/lib/Controller/ShareController.php b/apps/files_sharing/lib/Controller/ShareController.php index 99685f671d3..3bd65cd3974 100644 --- a/apps/files_sharing/lib/Controller/ShareController.php +++ b/apps/files_sharing/lib/Controller/ShareController.php @@ -164,7 +164,6 @@ class ShareController extends AuthPublicShareController { $csp = new ContentSecurityPolicy(); $csp->addAllowedConnectDomain('*'); $csp->addAllowedMediaDomain('blob:'); - $csp->allowEvalScript(true); $response->setContentSecurityPolicy($csp); } @@ -185,7 +184,6 @@ class ShareController extends AuthPublicShareController { $csp = new ContentSecurityPolicy(); $csp->addAllowedConnectDomain('*'); $csp->addAllowedMediaDomain('blob:'); - $csp->allowEvalScript(true); $response->setContentSecurityPolicy($csp); } -- cgit v1.2.3