diff --git a/views/bootstrap/class.Bootstrap.php b/views/bootstrap/class.Bootstrap.php index 8813b5b07..3ee68a7d9 100644 --- a/views/bootstrap/class.Bootstrap.php +++ b/views/bootstrap/class.Bootstrap.php @@ -44,7 +44,15 @@ class SeedDMS_Bootstrap_Style extends SeedDMS_View_Common { function htmlStartPage($title="", $bodyClass="") { /* {{{ */ if(method_exists($this, 'js')) { - $csp_rules = "script-src 'self';"; // style-src 'self';"; + /* We still need unsafe-eval, because printDocumentChooserHtml and + * printFolderChooserHtml will include a javascript file with ajax + * which is evaled by jquery + * X-WebKit-CSP is deprecated, Chrome understands Content-Security-Policy + * since version 25+ + * X-Content-Security-Policy is deprecated, Firefox understands + * Content-Security-Policy since version 23+ + */ + $csp_rules = "script-src 'self' 'unsafe-eval';"; // style-src 'self';"; foreach (array("X-WebKit-CSP", "X-Content-Security-Policy", "Content-Security-Policy") as $csp) { header($csp . ": " . $csp_rules); } @@ -913,7 +921,7 @@ function folderSelected(id, name) { getID() : "") ."\">"; print "