Changeset 3998:48e5fe3e4c22 for inc

Timestamp:

06/30/19 16:10:13 (6 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Remove unsafe-inline from CSP script-src directive (install/default/upgrade)

Location:

inc

Files:

• admin/lib.dc.page.php (modified) (1 diff)
• dbschema/upgrade.php (modified) (1 diff)

inc/admin/lib.dc.page.php

@@ -110 +110 @@
             $csp_prefix . "'self'" . $csp_suffix;
             $csp['script-src'] = $core->blog->settings->system->csp_admin_script ?:
-            $csp_prefix . "'self' 'unsafe-inline' 'unsafe-eval'" . $csp_suffix;
+            $csp_prefix . "'self' 'unsafe-eval'" . $csp_suffix;
             $csp['style-src'] = $core->blog->settings->system->csp_admin_style ?:
             $csp_prefix . "'self' 'unsafe-inline'" . $csp_suffix;

inc/dbschema/upgrade.php

@@ -671 +671 @@
                 @unlink(DC_ROOT . '/' . $f);
             }
+
+            // Remove unsafe-inline from CSP script directives
+            $strReq = 'UPDATE ' . $core->prefix . 'setting ' .
+                " SET setting_value = REPLACE(setting_value, \"'unsafe-inline'\", '') " .
+                " WHERE setting_id = 'csp_admin_script' " .
+                " AND setting_ns = 'system' ";
+            $core->con->execute($strReq);
         }