From 7276735eb423ed126333923bb921d9d4bef16f07 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Wed, 3 Apr 2019 18:42:34 +0200 Subject: Set empty CSP by default For #14179 By default responses should have the strictest (and simplest) CSP possible. Only template responses should require an actual CSP. Signed-off-by: Roeland Jago Douma --- tests/lib/AppFramework/Http/DataResponseTest.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tests/lib/AppFramework/Http/DataResponseTest.php') diff --git a/tests/lib/AppFramework/Http/DataResponseTest.php b/tests/lib/AppFramework/Http/DataResponseTest.php index 67ffdde8669..e0eca83f6e9 100644 --- a/tests/lib/AppFramework/Http/DataResponseTest.php +++ b/tests/lib/AppFramework/Http/DataResponseTest.php @@ -68,7 +68,7 @@ class DataResponseTest extends \Test\TestCase { $expectedHeaders = [ 'Cache-Control' => 'no-cache, no-store, must-revalidate', - 'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-ancestors 'self'", + 'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self'", ]; $expectedHeaders = array_merge($expectedHeaders, $headers); -- cgit v1.2.3