From 1b5852ad0b50d30da87b2ed7627942ca9a077e01 Mon Sep 17 00:00:00 2001 From: Thomas Piccirello Date: Sun, 14 May 2017 01:29:25 -0400 Subject: [PATCH] Use less permissive Content Security Policy Adjust content order --- src/webui/abstractwebapplication.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/webui/abstractwebapplication.cpp b/src/webui/abstractwebapplication.cpp index e529f4137..7f45153d5 100644 --- a/src/webui/abstractwebapplication.cpp +++ b/src/webui/abstractwebapplication.cpp @@ -110,7 +110,7 @@ Http::Response AbstractWebApplication::processRequest(const Http::Request &reque header(Http::HEADER_X_FRAME_OPTIONS, "SAMEORIGIN"); header(Http::HEADER_X_XSS_PROTECTION, "1; mode=block"); header(Http::HEADER_X_CONTENT_TYPE_OPTIONS, "nosniff"); - header(Http::HEADER_CONTENT_SECURITY_POLICY, "default-src 'self' 'unsafe-inline' 'unsafe-eval';"); + header(Http::HEADER_CONTENT_SECURITY_POLICY, "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; object-src 'none';"); sessionInitialize(); if (!sessionActive() && !isAuthNeeded())