Changeset 3307:c3d5e26b6ed4 for inc/admin/lib.dc.page.php

Timestamp:

08/15/16 08:16:04 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.10

Message:

Prevents CSP directive violation in media manager and post/page preview

File:

• inc/admin/lib.dc.page.php (modified) (1 diff)

inc/admin/lib.dc.page.php

@@ -110 +110 @@
                $csp['style-src'] = $core->blog->settings->system->csp_admin_style ? $core->blog->settings->system->csp_admin_style : "'self' 'unsafe-inline'";
                $csp['img-src'] = $core->blog->settings->system->csp_admin_img ? $core->blog->settings->system->csp_admin_img : "'self' data: media.dotaddict.org";
+
+               # Cope with blog post preview (via public URL in iframe)
+               if (!is_null($core->blog->host)) {
+                    $csp['default-src'] .= ' '.parse_url($core->blog->host,PHP_URL_HOST);
+               }
+               # Cope with media display in media manager (via public URL)
+               if (!is_null($core->media)) {
+                    $csp['img-src'] .= ' '.parse_url($core->media->root_url,PHP_URL_HOST);
+               }
 
                # --BEHAVIOR-- adminPageHTTPHeaderCSP