From ea935f65fdc94b94b4509a139477b52f046dc03f Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Mon, 8 Jul 2019 20:54:45 +0100 Subject: Add support for CSP_NONCE server variable Allow passing a nonce from the web server, allowing the possibility to enforce a strict CSP from the web server. Signed-off-by: Sam Bull Signed-off-by: Roeland Jago Douma --- lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php index 795d8cc8642..f4743369e6e 100644 --- a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php +++ b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php @@ -58,7 +58,11 @@ class ContentSecurityPolicyNonceManager { */ public function getNonce(): string { if($this->nonce === '') { - $this->nonce = base64_encode($this->csrfTokenManager->getToken()->getEncryptedValue()); + if (empty($this->request->server['CSP_NONCE'])) { + $this->nonce = base64_encode($this->csrfTokenManager->getToken()->getEncryptedValue()); + } else { + $this->nonce = $this->request->server['CSP_NONCE']; + } } return $this->nonce; -- cgit v1.2.3