From fdcb8edd78c645e722716fec1d12fa8fac750553 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Wed, 26 Oct 2016 09:41:18 +0200 Subject: [PATCH] Add nonce also to legacy CSP Pages that do not use the AppFramework have its CSP inherited from `\OC_Response::addSecurityHeaders`. While those are not many anymore, there are some examples such as the "Help" page. To stay completely backwards-compatible we should also add the nonce to the legacy CSP response. To test that open your browser console and open the help page. Without this you will get a JS error. With this you won't. Signed-off-by: Lukas Reschke --- lib/private/legacy/response.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/private/legacy/response.php b/lib/private/legacy/response.php index 88725d5e30..69c84e2df6 100644 --- a/lib/private/legacy/response.php +++ b/lib/private/legacy/response.php @@ -247,7 +247,7 @@ class OC_Response { * @see \OCP\AppFramework\Http\Response::getHeaders */ $policy = 'default-src \'self\'; ' - . 'script-src \'self\' \'unsafe-eval\'; ' + . 'script-src \'self\' \'unsafe-eval\' \'nonce-'.\OC::$server->getContentSecurityPolicyNonceManager()->getNonce().'\'; ' . 'style-src \'self\' \'unsafe-inline\'; ' . 'frame-src *; ' . 'img-src * data: blob:; '