gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-02-11 17:44:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

setting more http headers to improve security

Browse Source
This commit is contained in:
Uwe Steinmann 2020-03-13 19:43:47 +01:00
parent 7fcc100ae7
commit 8497e652f6
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
views/bootstrap/class.Bootstrap.php
View File

@ -57,12 +57,17 @@ class SeedDMS_Bootstrap_Style extends SeedDMS_View_Common {
* Content-Security-Policy since version 23+
* 'worker-src blob:' is needed for cytoscape
*/
$csp_rules = "script-src 'self' 'unsafe-eval'; worker-src blob:;"; // style-src 'self';";
$csp_rules = "script-src 'self' 'unsafe-eval';";
$csp_rules .= "worker-src blob:;";
//$csp_rules .= "style-src 'self';";
/* Do not allow to embed myself into frames on foreigns pages */
$csp_rules .= "frame-ancestors 'self';";
foreach (array("X-WebKit-CSP", "X-Content-Security-Policy", "Content-Security-Policy") as $csp) {
header($csp . ": " . $csp_rules);
}
}
// header('X-Content-Type-Options: nosniff');
header('X-Content-Type-Options: nosniff');
header('Strict-Transport-Security: max-age=15768000');
if($httpheader) {
foreach($httpheader as $name=>$value) {
header($name . ": " . $value);