Ubuntu

policies['default-src'] = self::RULE_DEFAULT; $this->policies['img-src'] = self::RULE_IMG_DEFAULT; $generalConfig = $config->General; $this->cspEnabled = $generalConfig['csp_enabled'] ?? true; $this->reportOnly = $generalConfig['csp_report_only'] ?? false; } /** * Appends a policy to a directive. * * @api */ public function addPolicy($directive, $value) { if (isset($this->policies[$directive])) { $this->policies[$directive] .= ' ' . $value; } else { $this->policies[$directive] = $value; } } /** * Removes a directive. * * @api */ public function removeDirective($directive) { if (isset($this->policies[$directive])) { unset($this->policies[$directive]); } } /** * Overrides a directive. * * @api */ public function overridePolicy($directive, $value) { $this->policies[$directive] = $value; } /** * Disable CSP * * @api */ public function disable() { $this->cspEnabled = false; } /** * Creates the Header String that can be inserted in the Content-Security-Policy header. * * @return string */ public function createHeaderString() { if (!$this->cspEnabled) { return ''; } if ($this->reportOnly) { $headerString = 'Content-Security-Policy-Report-Only: '; } else { $headerString = 'Content-Security-Policy: '; } foreach ($this->policies as $directive => $values) { $headerString .= $directive . ' ' . $values . '; '; } return $headerString; } /** * A less restrictive CSP which will allow embedding other sites with iframes * (useful for heatmaps and session recordings) * * @api */ public function allowEmbedPage() { $this->overridePolicy('default-src', self::RULE_EMBEDDED_FRAME); $this->overridePolicy('img-src', self::RULE_EMBEDDED_FRAME); $this->addPolicy('script-src', self::RULE_DEFAULT); } }