upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-09 08:44:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

fix(CSP): Add CSP nonce by default and convert browserSupportsCspV3 to blocklist

Browse source 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
This commit is contained in:
Ferdinand Thiessen 2024-03-22 16:03:29 +01:00
parent 4121b841de
commit 5a513c924f
No known key found for this signature in database
GPG key ID: 45FAE7268762B400
1 changed files with 5 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php
View file

@ -65,17 +65,14 @@ class ContentSecurityPolicyNonceManager {
* Check if the browser supports CSP v3
*/
public function browserSupportsCspV3(): bool {
$browserWhitelist = [
Request::USER_AGENT_CHROME,
Request::USER_AGENT_FIREFOX,
Request::USER_AGENT_SAFARI,
Request::USER_AGENT_MS_EDGE,
$browserBlocklist = [
Request::USER_AGENT_IE,
];
if ($this->request->isUserAgent($browserWhitelist)) {
return true;
if ($this->request->isUserAgent($browserBlocklist)) {
return false;
}
return false;
return true;
}
}