Changeset 3326:6735e0420ee9

Timestamp:

08/27/16 12:34:53 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Add a CSP Report only option for admin (see about:config), default → false

Files:

• admin/install/index.php (modified) (1 diff)
• inc/admin/lib.dc.page.php (modified) (1 diff)
• inc/dbschema/upgrade.php (modified) (1 diff)

admin/install/index.php

@@ -172 +172 @@
           # CSP directive (admin part)
           $blog_settings->system->put('csp_admin_on',true,'boolean','Send CSP header (admin)',true,true);
+          $blog_settings->system->put('csp_admin_report_only',false,'boolean','CSP Report only violations (admin)',true,true);
           $blog_settings->system->put('csp_admin_default',"'self'",'string','CSP default-src directive',true,true);
           $blog_settings->system->put('csp_admin_script',"'self' 'unsafe-inline' 'unsafe-eval'",'string','CSP script-src directive',true,true);

inc/admin/lib.dc.page.php

@@ -137 +137 @@
                          $directives[] = "report-uri ".DC_ADMIN_URL."csp_report.php";
                     }
-                    $headers['csp'] = "Content-Security-Policy: ".implode(" ; ",$directives);
+                    $report_only = ($core->blog->settings->system->csp_admin_report_only) ? '-Report-Only' : '';
+                    $headers['csp'] = "Content-Security-Policy".$report_only.": ".implode(" ; ",$directives);
                }
           }

inc/dbschema/upgrade.php

@@ -594 +594 @@
                // Remove the CSP report file from it's old place
                @unlink(DC_ROOT.'/admin/csp_report.txt');
+
+               # Some new settings should be initialized, prepare db queries
+               $strReq = 'INSERT INTO '.$core->prefix.'setting'.
+                         ' (setting_id,setting_ns,setting_value,setting_type,setting_label)'.
+                         ' VALUES(\'%s\',\'system\',\'%s\',\'%s\',\'%s\')';
+               $core->con->execute(
+                    sprintf($strReq,'csp_admin_report_only',false,'boolean','CSP Report only violations (admin)'));
           }