dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Finish portal CSP (#1138)

Browse Source
This commit is contained in:
Xavier Guimard 2017-01-19 22:04:33 +00:00
parent 942be4148b
commit 2dd22811a0
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Run.pm
View File

@ -634,14 +634,13 @@ sub _dump {
sub sendHtml {
my ( $self, $req, $template, %args ) = @_;
my $csp = $self->csp;
my $csp = $self->csp . "form-action 'self'";
push @{ $req->respHeaders },
'X-XSS-Protection' => '1; mode=block',
'X-Content-Type-Options' => 'nosniff';
$csp .= "form-action 'self'";
my $url = $args{params}->{URL};
if ( $url and $url =~ s#https?://([^/]+).*#$1# ) {
$csp .= $url;
$csp .= " $url";
}
$csp .= ';';
unless ( $self->conf->{portalAntiFrame} == 0 ) {
@ -651,7 +650,7 @@ sub sendHtml {
( $req->info =~ /<iframe.*?src="(.*?)"/sg );
}
if (@url) {
$csp = join 'frame-ancestors', @url;
$csp .= join( ' ', 'frame-ancestors', @url ) . ';';
}
else {
push @{ $req->respHeaders }, 'X-Frame-Options' => 'DENY';