Changeset 3988:798dd7e86493

Timestamp:

06/28/19 13:00:12 (6 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Set specific CSP for CKEditor 4.x

Location:

plugins/dcCKEditor

Files:

• _admin.php (modified) (1 diff)
• inc/dc.ckeditor.behaviors.php (modified) (1 diff)

plugins/dcCKEditor/_admin.php

@@ -30 +30 @@
 
     $core->addBehavior('adminMediaURL', ['dcCKEditorBehaviors', 'adminMediaURL']);
+
+    $core->addBehavior('adminPageHTTPHeaderCSP', ['dcCKEditorBehaviors', 'adminPageHTTPHeaderCSP']);
 }

plugins/dcCKEditor/inc/dc.ckeditor.behaviors.php

@@ -93 +93 @@
         return self::$tagsContext;
     }
+
+    public static function adminPageHTTPHeaderCSP($csp)
+    {
+        return;
+        // add 'unsafe-inline' for CSS, add 'unsafe-eval' for scripts as far as CKEditor 4.x is used
+        $csp['style-src'] .= " 'unsafe-inline'";
+        $csp['script-src'] .= " 'unsafe-inline' 'unsafe-eval'";
+    }
 }