diff options
Diffstat (limited to 'boot.php')
| -rw-r--r-- | boot.php | 10 |
1 files changed, 6 insertions, 4 deletions
@@ -2423,10 +2423,12 @@ function construct_page() { header("Strict-Transport-Security: max-age=31536000"); if(isset(App::$config['system']['content_security_policy'])) { - $cspsettings = Array ( - 'script-src' => Array ("'self'","'unsafe-inline'","'unsafe-eval'"), - 'style-src' => Array ("'self'","'unsafe-inline'") - ); + $cspsettings = [ + 'script-src' => [ "'self'", "'unsafe-inline'", "'unsafe-eval'" ], + 'style-src' => [ "'self'", "'unsafe-inline'" ], + 'frame-src' => [ "'self'" ] + ]; + call_hooks('content_security_policy',$cspsettings); // Legitimate CSP directives (cxref: https://content-security-policy.com/) |