kenmirrors/firefly-iii
1
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2025-09-04 03:43:07 +00:00
Code Issues Projects Releases Wiki Activity

Merge branch 'develop' of github.com:firefly-iii/firefly-iii into develop

Browse Source
This commit is contained in:
James Cole
2022-01-20 06:11:09 +01:00
parent ac1137d7e8 52ad0ba352
commit 78ebec01a4
7 changed files with 137 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
app/Http/Middleware/SecureHeaders.php
View File

@@ -50,14 +50,15 @@ class SecureHeaders
$response = $next($request);
$trackingScriptSrc = $this->getTrackingScriptSource();
$newRelicSrc = $this->getNewRelicSource();
$csp = [
"default-src 'none'",
"object-src 'none'",
sprintf("script-src 'unsafe-eval' 'strict-dynamic' 'self' 'unsafe-inline' 'nonce-%1s' %2s", $nonce, $trackingScriptSrc),
sprintf("script-src 'unsafe-eval' 'strict-dynamic' 'self' 'unsafe-inline' 'nonce-%1s' %2s %3s", $nonce, $trackingScriptSrc, $newRelicSrc),
"style-src 'unsafe-inline' 'self'",
"base-uri 'self'",
"font-src 'self' data:",
"connect-src 'self'",
sprintf("connect-src 'self' %s %s", $trackingScriptSrc, $newRelicSrc),
sprintf("img-src data: 'strict-dynamic' 'self' *.tile.openstreetmap.org %s", $trackingScriptSrc),
"manifest-src 'self'",
];
@@ -102,7 +103,19 @@ class SecureHeaders
}
/**
* Return part of a CSP header allowing scripts from Google.
* Returns the domain name of New Relic (used on the demo site)
* The check for this value is an undocumented .env variable
*/
private function getNewRelicSource(): string
{
if(true === env('ENABLE_NEW_RELIC', false)) {
return 'bam.eu01.nr-data.net';
}
return '';
}
/**
* Return part of a CSP header allowing scripts from Matomo.
*
* @return string
*/