mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-05-24 08:14:56 -04:00
Code Issues Packages Projects Releases Wiki Activity

tec: Allow to change CSP header from controllers

Browse Source 
For an extension, I needed to call a script from an external domain.
Unfortunately, the CSP headers didn't allow this domain and I had to
patch manually the FreshRSS FrontController for my extension. It's
obviously not a long-term solution since it has nothing to do in the
core of FRSS, and I don't want to apply this patch manually at each
update.

With this patch, I allow changing the CSP header from inside the
controller actions. It allows extensions to modify headers. It's also an
opportunity to remove a bit of code from the FrontController. I wasn't
happy with the previous implementation anyhow.

Reference: https://github.com/flusio/xExtension-Flus/commit/ed12d56#diff-ff12e33ed31b23bda327499fa6e84eccR143
This commit is contained in:
Marien Fressinaud
2019-12-07 19:29:23 +01:00
parent 2b1f8e67f7
commit 7802fd33a6
5 changed files with 56 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/Controllers/indexController.php
View File

@@ -83,6 +83,13 @@ class FreshRSS_index_Controller extends Minz_ActionController {
Minz_Error::error(404);
}
};
$this->_csp([
'default-src' => "'self'",
'frame-src' => '*',
'img-src' => '* data:',
'media-src' => '*',
]);
}
/**
@@ -121,6 +128,13 @@ class FreshRSS_index_Controller extends Minz_ActionController {
$title = '(' . FreshRSS_Context::$get_unread . ') ' . $title;
}
Minz_View::prependTitle($title . ' · ');
$this->_csp([
'default-src' => "'self'",
'frame-src' => '*',
'img-src' => '* data:',
'media-src' => '*',
]);
}
/**