nextcloud
/
server
mirror of https://github.com/nextcloud/server
0
0
Fork 0
Code Issues Releases Wiki Activity

fix(CSP): Add CSP nonce by default and convert `browserSupportsCspV3` to blocklist 

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
This commit is contained in:
Ferdinand Thiessen 2024-03-22 16:03:29 +01:00
parent 4121b841de
commit 5a513c924f
No known key found for this signature in database
GPG Key ID: 45FAE7268762B400
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php
View File

@ -65,17 +65,14 @@ class ContentSecurityPolicyNonceManager {
* Check if the browser supports CSP v3
*/
public function browserSupportsCspV3(): bool {
$browserWhitelist = [
Request::USER_AGENT_CHROME,
Request::USER_AGENT_FIREFOX,
Request::USER_AGENT_SAFARI,
Request::USER_AGENT_MS_EDGE,
$browserBlocklist = [
Request::USER_AGENT_IE,
];
if ($this->request->isUserAgent($browserWhitelist)) {
return true;
if ($this->request->isUserAgent($browserBlocklist)) {
return false;
}
return false;
return true;
}
}