1 files changed, 7 insertions, 6 deletions
diff --git a/vendor/sabre/dav/lib/DAV/Browser/Plugin.php b/vendor/sabre/dav/lib/DAV/Browser/Plugin.php
index 07ca6c3e5..49359a045 100644
--- a/vendor/sabre/dav/lib/DAV/Browser/Plugin.php
+++ b/vendor/sabre/dav/lib/DAV/Browser/Plugin.php
@@ -48,7 +48,7 @@ class Plugin extends DAV\ServerPlugin {
     public $uninterestingProperties = [
         '{DAV:}supportedlock',
         '{DAV:}acl-restrictions',
-        '{DAV:}supported-privilege-set',
+//        '{DAV:}supported-privilege-set',
         '{DAV:}supported-method-set',
     ];
 
@@ -112,7 +112,7 @@ class Plugin extends DAV\ServerPlugin {
         $getVars = $request->getQueryParameters();
 
         // CSP headers
-        $this->server->httpResponse->setHeader('Content-Security-Policy', "img-src 'self'; style-src 'self';");
+        $this->server->httpResponse->setHeader('Content-Security-Policy', "default-src 'none'; img-src 'self'; style-src 'self'; font-src 'self';");
 
         $sabreAction = isset($getVars['sabreAction']) ? $getVars['sabreAction'] : null;
 
@@ -354,7 +354,7 @@ class Plugin extends DAV\ServerPlugin {
 
         $output = '';
         if ($this->enablePost) {
-            $this->server->emit('onHTMLActionsPanel', [$node, &$output]);
+            $this->server->emit('onHTMLActionsPanel', [$node, &$output, $path]);
         }
 
         if ($output) {
@@ -368,7 +368,7 @@ class Plugin extends DAV\ServerPlugin {
 
         $html .= $this->generateFooter();
 
-        $this->server->httpResponse->setHeader('Content-Security-Policy', "img-src 'self'; style-src 'self';");
+        $this->server->httpResponse->setHeader('Content-Security-Policy', "default-src 'none'; img-src 'self'; style-src 'self'; font-src 'self';");
 
         return $html;
 
@@ -477,7 +477,7 @@ HTML;
 
         $version = DAV\Version::VERSION;
         return <<<HTML
-<footer>Generated by SabreDAV $version (c)2007-2015 <a href="http://sabre.io/">http://sabre.io/</a></footer>
+<footer>Generated by SabreDAV $version (c)2007-2016 <a href="http://sabre.io/">http://sabre.io/</a></footer>
 </body>
 </html>
 HTML;
@@ -493,9 +493,10 @@ HTML;
      *
      * @param DAV\INode $node
      * @param mixed $output
+     * @param string $path
      * @return void
      */
-    function htmlActionsPanel(DAV\INode $node, &$output) {
+    function htmlActionsPanel(DAV\INode $node, &$output, $path) {
 
         if (!$node instanceof DAV\ICollection)
             return;