mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #11974 from nextcloud/bugfix/noid/lax-csp-on-talk-shares 

Use lax CSP when the share is a talk share
This commit is contained in:
Roeland Jago Douma 2018-10-23 14:29:52 +02:00 committed by GitHub
parent 7c0cd4f9ff 3febeb6ca7
commit d11609a152
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
apps/files_sharing/lib/Controller/ShareController.php
View File

@ -35,6 +35,7 @@
namespace OCA\Files_Sharing\Controller;
use OC\Security\CSP\ContentSecurityPolicy;
use OC_Files;
use OC_Util;
use OCA\FederatedFileSharing\FederatedShareProvider;
@ -158,7 +159,16 @@ class ShareController extends AuthPublicShareController {
$event = new GenericEvent(null, $templateParameters);
$this->eventDispatcher->dispatch('OCA\Files_Sharing::loadAdditionalScripts::publicShareAuth', $event);
return new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
$response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
if ($this->share->getSendPasswordByTalk()) {
$csp = new ContentSecurityPolicy();
$csp->addAllowedConnectDomain('*');
$csp->addAllowedMediaDomain('blob:');
$csp->allowEvalScript(true);
$response->setContentSecurityPolicy($csp);
}
return $response;
}
/**
@ -170,7 +180,16 @@ class ShareController extends AuthPublicShareController {
$event = new GenericEvent(null, $templateParameters);
$this->eventDispatcher->dispatch('OCA\Files_Sharing::loadAdditionalScripts::publicShareAuth', $event);
return new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
$response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
if ($this->share->getSendPasswordByTalk()) {
$csp = new ContentSecurityPolicy();
$csp->addAllowedConnectDomain('*');
$csp->addAllowedMediaDomain('blob:');
$csp->allowEvalScript(true);
$response->setContentSecurityPolicy($csp);
}
return $response;
}
protected function verifyPassword(string $password): bool {