Changeset 3401:47b013a91ab9

Timestamp:

11/10/16 15:32:24 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Add blob: to CSP img-src default directive, closes #2218

Files:

• admin/install/index.php (modified) (1 diff)
• inc/admin/lib.dc.page.php (modified) (1 diff)
• inc/dbschema/upgrade.php (modified) (1 diff)

admin/install/index.php

@@ -176 +176 @@
           $blog_settings->system->put('csp_admin_script',"'self' 'unsafe-inline' 'unsafe-eval'",'string','CSP script-src directive',true,true);
           $blog_settings->system->put('csp_admin_style',"'self' 'unsafe-inline'",'string','CSP style-src directive',true,true);
-          $blog_settings->system->put('csp_admin_img',"'self' data: media.dotaddict.org",'string','CSP img-src directive',true,true);
+          $blog_settings->system->put('csp_admin_img',"'self' data: media.dotaddict.org blob:",'string','CSP img-src directive',true,true);
 
           # Add Dotclear version

inc/admin/lib.dc.page.php

@@ -109 +109 @@
                $csp['script-src'] = $core->blog->settings->system->csp_admin_script ?: "'self' 'unsafe-inline' 'unsafe-eval'";
                $csp['style-src'] = $core->blog->settings->system->csp_admin_style ?: "'self' 'unsafe-inline'";
-               $csp['img-src'] = $core->blog->settings->system->csp_admin_img ?: "'self' data: media.dotaddict.org";
+               $csp['img-src'] = $core->blog->settings->system->csp_admin_img ?: "'self' data: media.dotaddict.org blob:";
 
                # Cope with blog post preview (via public URL in iframe)

inc/dbschema/upgrade.php

@@ -602 +602 @@
                     sprintf($strReq,'csp_admin_report_only',false,'boolean','CSP Report only violations (admin)'));
 
+               # Update CSP img-src default directive
+               $strReq = 'UPDATE '.$core->prefix.'setting '.
+                         " SET setting_value = '\'self\' data: media.dotaddict.org blob:' ".
+                         " WHERE setting_id = 'csp_admin_img' ".
+                         " AND setting_ns = 'system' ".
+                         " AND setting_value = '\'self\' data: media.dotaddict.org' ";
+               $core->con->execute($strReq);
+
                # A bit of housecleaning for no longer needed files
                $remfiles = array (