mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #15049 from nextcloud/do-not-allow-javascript-eval-in-the-public-share-auth-page-with-talk 

Do not allow JavaScript "eval" in the public share auth page with Talk
This commit is contained in:
Morris Jobke 2019-04-11 09:43:53 +02:00 committed by GitHub
parent 7641a1589f dfe9e3fb2e
commit aac22ba40f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apps/files_sharing/lib/Controller/ShareController.php
View File

@ -164,7 +164,6 @@ class ShareController extends AuthPublicShareController {
$csp = new ContentSecurityPolicy();
$csp->addAllowedConnectDomain('*');
$csp->addAllowedMediaDomain('blob:');
$csp->allowEvalScript(true);
$response->setContentSecurityPolicy($csp);
}
@ -185,7 +184,6 @@ class ShareController extends AuthPublicShareController {
$csp = new ContentSecurityPolicy();
$csp->addAllowedConnectDomain('*');
$csp->addAllowedMediaDomain('blob:');
$csp->allowEvalScript(true);
$response->setContentSecurityPolicy($csp);
}