diff options
author | Mario <mario@mariovavti.com> | 2024-04-30 06:59:20 +0000 |
---|---|---|
committer | Mario <mario@mariovavti.com> | 2024-04-30 06:59:20 +0000 |
commit | ce15852b9a57a6c77531186ed24a389ebce8524e (patch) | |
tree | ad04cef0d545c5e5e24e76060b6c32d65363d48e /doc/en/hook/content_security_policy.bb | |
parent | 48cec945051d259a06871d937ad998a1bd3e22ec (diff) | |
parent | 7c34a3676d294c9a1acc69f71ab3061074509160 (diff) | |
download | volse-hubzilla-ce15852b9a57a6c77531186ed24a389ebce8524e.tar.gz volse-hubzilla-ce15852b9a57a6c77531186ed24a389ebce8524e.tar.bz2 volse-hubzilla-ce15852b9a57a6c77531186ed24a389ebce8524e.zip |
Merge branch 'rework-help-module' into 'dev'
Rework Help module + begin tests for Setup module
See merge request hubzilla/core!2120
Diffstat (limited to 'doc/en/hook/content_security_policy.bb')
-rw-r--r-- | doc/en/hook/content_security_policy.bb | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/doc/en/hook/content_security_policy.bb b/doc/en/hook/content_security_policy.bb new file mode 100644 index 000000000..96b8095ae --- /dev/null +++ b/doc/en/hook/content_security_policy.bb @@ -0,0 +1,39 @@ +[h2]content_security_policy[/h2] + +Called to modify CSP settings prior to the output of the Content-Security-Policy header. + +This hook permits addons to modify the content-security-policy if necessary to allow loading of foreign js libraries or css styles. + +[code] +if(App::$config['system']['content_security_policy']) { + $cspsettings = Array ( + 'script-src' => Array ("'self'","'unsafe-inline'","'unsafe-eval'"), + 'style-src' => Array ("'self'","'unsafe-inline'") + ); + call_hooks('content_security_policy',$cspsettings); + + // Legitimate CSP directives (cxref: https://content-security-policy.com/) + $validcspdirectives=Array( + "default-src", "script-src", "style-src", + "img-src", "connect-src", "font-src", + "object-src", "media-src", 'frame-src', + 'sandbox', 'report-uri', 'child-src', + 'form-action', 'frame-ancestors', 'plugin-types' + ); + $cspheader = "Content-Security-Policy:"; + foreach ($cspsettings as $cspdirective => $csp) { + if (!in_array($cspdirective,$validcspdirectives)) { + logger("INVALID CSP DIRECTIVE: ".$cspdirective,LOGGER_DEBUG); + continue; + } + $cspsettingsarray=array_unique($cspsettings[$cspdirective]); + $cspsetpolicy = implode(' ',$cspsettingsarray); + if ($cspsetpolicy) { + $cspheader .= " ".$cspdirective." ".$cspsetpolicy.";"; + } + } + header($cspheader); +} +[/code] + +see: boot.php |