nextcloud /
server
@@ -4,7 +4,7 @@ discard block |
||
| 4 | 4 | <meta charset="utf-8"> |
| 5 | 5 | <title> |
| 6 | 6 | <?php |
| 7 | - p(!empty($_['application'])?$_['application'].' - ':''); |
|
| 7 | + p(!empty($_['application']) ? $_['application'].' - ' : ''); |
|
| 8 | 8 | p($theme->getTitle()); |
| 9 | 9 | ?> |
| 10 | 10 | </title> |
@@ -14,17 +14,17 @@ discard block |
||
| 14 | 14 | <meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>"> |
| 15 | 15 | <meta name="apple-mobile-web-app-capable" content="yes"> |
| 16 | 16 | <meta name="apple-mobile-web-app-status-bar-style" content="black"> |
| 17 | - <meta name="apple-mobile-web-app-title" content="<?php p((!empty($_['application']) && $_['appid']!='files')? $_['application']:$theme->getTitle()); ?>"> |
|
| 17 | + <meta name="apple-mobile-web-app-title" content="<?php p((!empty($_['application']) && $_['appid'] != 'files') ? $_['application'] : $theme->getTitle()); ?>"> |
|
| 18 | 18 | <meta name="mobile-web-app-capable" content="yes"> |
| 19 | 19 | <meta name="theme-color" content="<?php p($theme->getMailHeaderColor()); ?>"> |
| 20 | 20 | <link rel="icon" href="<?php print_unescaped(image_path($_['appid'], 'favicon.ico')); /* IE11+ supports png */ ?>"> |
| 21 | 21 | <link rel="apple-touch-icon-precomposed" href="<?php print_unescaped(image_path($_['appid'], 'favicon-touch.png')); ?>"> |
| 22 | 22 | <link rel="mask-icon" sizes="any" href="<?php print_unescaped(image_path($_['appid'], 'favicon-mask.svg')); ?>" color="#0082c9"> |
| 23 | 23 | <link rel="manifest" href="<?php print_unescaped(image_path($_['appid'], 'manifest.json')); ?>"> |
| 24 | - <?php foreach($_['cssfiles'] as $cssfile): ?> |
|
| 24 | + <?php foreach ($_['cssfiles'] as $cssfile): ?> |
|
| 25 | 25 | <link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>"> |
| 26 | 26 | <?php endforeach; ?> |
| 27 | - <?php foreach($_['printcssfiles'] as $cssfile): ?> |
|
| 27 | + <?php foreach ($_['printcssfiles'] as $cssfile): ?> |
|
| 28 | 28 | <link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>" media="print"> |
| 29 | 29 | <?php endforeach; ?> |
| 30 | 30 | <?php if (isset($_['inline_ocjs'])): ?> |
@@ -32,12 +32,12 @@ discard block |
||
| 32 | 32 | <?php print_unescaped($_['inline_ocjs']); ?> |
| 33 | 33 | </script> |
| 34 | 34 | <?php endif; ?> |
| 35 | - <?php foreach($_['jsfiles'] as $jsfile): ?> |
|
| 35 | + <?php foreach ($_['jsfiles'] as $jsfile): ?> |
|
| 36 | 36 | <script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" src="<?php print_unescaped($jsfile); ?>"></script> |
| 37 | 37 | <?php endforeach; ?> |
| 38 | 38 | <?php print_unescaped($_['headers']); ?> |
| 39 | 39 | </head> |
| 40 | - <body id="<?php p($_['bodyid']);?>"> |
|
| 40 | + <body id="<?php p($_['bodyid']); ?>"> |
|
| 41 | 41 | <?php include('layout.noscript.warning.php'); ?> |
| 42 | 42 | <div id="notification-container"> |
| 43 | 43 | <div id="notification"></div> |
@@ -55,18 +55,18 @@ discard block |
||
| 55 | 55 | |
| 56 | 56 | <a href="#" class="header-appname-container menutoggle" tabindex="2"> |
| 57 | 57 | <h1 class="header-appname"> |
| 58 | - <?php p(!empty($_['application'])?$_['application']: $l->t('Apps')); ?> |
|
| 58 | + <?php p(!empty($_['application']) ? $_['application'] : $l->t('Apps')); ?> |
|
| 59 | 59 | </h1> |
| 60 | 60 | <div class="icon-caret"></div> |
| 61 | 61 | </a> |
| 62 | 62 | |
| 63 | 63 | <div id="appmenu"> |
| 64 | 64 | <ul> |
| 65 | - <?php foreach($_['headernavigation'] as $entry): ?> |
|
| 65 | + <?php foreach ($_['headernavigation'] as $entry): ?> |
|
| 66 | 66 | <li data-id="<?php p($entry['id']); ?>"> |
| 67 | 67 | <a href="<?php print_unescaped($entry['href']); ?>" tabindex="3" |
| 68 | - <?php if( $entry['active'] ): ?> class="active"<?php endif; ?>> |
|
| 69 | - <img src="<?php print_unescaped($entry['icon'] . '?v=' . $_['versionHash']); ?>" class="app-icon" /> |
|
| 68 | + <?php if ($entry['active']): ?> class="active"<?php endif; ?>> |
|
| 69 | + <img src="<?php print_unescaped($entry['icon'].'?v='.$_['versionHash']); ?>" class="app-icon" /> |
|
| 70 | 70 | <div class="icon-loading-dark" style="display:none;"></div> |
| 71 | 71 | <span> |
| 72 | 72 | <?php p($entry['name']); ?> |
@@ -86,17 +86,17 @@ discard block |
||
| 86 | 86 | <nav role="navigation"><div id="navigation"> |
| 87 | 87 | <div id="apps"> |
| 88 | 88 | <ul> |
| 89 | - <?php foreach($_['navigation'] as $entry): ?> |
|
| 90 | - <?php if($entry['showInHeader']): ?> |
|
| 89 | + <?php foreach ($_['navigation'] as $entry): ?> |
|
| 90 | + <?php if ($entry['showInHeader']): ?> |
|
| 91 | 91 | <li data-id="<?php p($entry['id']); ?>" class="in-header"> |
| 92 | 92 | <?php else: ?> |
| 93 | 93 | <li data-id="<?php p($entry['id']); ?>"> |
| 94 | 94 | <?php endif; ?> |
| 95 | 95 | <a href="<?php print_unescaped($entry['href']); ?>" tabindex="3" |
| 96 | - <?php if( $entry['active'] ): ?> class="active"<?php endif; ?>> |
|
| 96 | + <?php if ($entry['active']): ?> class="active"<?php endif; ?>> |
|
| 97 | 97 | <svg width="32" height="32" viewBox="0 0 32 32"> |
| 98 | 98 | <defs><filter id="invert-<?php p($entry['id']); ?>"><feColorMatrix in="SourceGraphic" type="matrix" values="-1 0 0 0 1 0 -1 0 0 1 0 0 -1 0 1 0 0 0 1 0"></feColorMatrix></filter></defs> |
| 99 | - <image x="0" y="0" width="32" height="32" preserveAspectRatio="xMinYMin meet" filter="url(#invert-<?php p($entry['id']); ?>)" xlink:href="<?php print_unescaped($entry['icon'] . '?v=' . $_['versionHash']); ?>" class="app-icon"></image> |
|
| 99 | + <image x="0" y="0" width="32" height="32" preserveAspectRatio="xMinYMin meet" filter="url(#invert-<?php p($entry['id']); ?>)" xlink:href="<?php print_unescaped($entry['icon'].'?v='.$_['versionHash']); ?>" class="app-icon"></image> |
|
| 100 | 100 | </svg> |
| 101 | 101 | <div class="icon-loading-dark" style="display:none;"></div> |
| 102 | 102 | <span> |
@@ -114,7 +114,7 @@ discard block |
||
| 114 | 114 | <div id="header-right"> |
| 115 | 115 | <form class="searchbox" action="#" method="post" role="search" novalidate> |
| 116 | 116 | <label for="searchbox" class="hidden-visually"> |
| 117 | - <?php p($l->t('Search'));?> |
|
| 117 | + <?php p($l->t('Search')); ?> |
|
| 118 | 118 | </label> |
| 119 | 119 | <input id="searchbox" type="search" name="query" |
| 120 | 120 | value="" required |
@@ -126,8 +126,8 @@ discard block |
||
| 126 | 126 | <div class="avatardiv<?php if ($_['userAvatarSet']) { print_unescaped(' avatardiv-shown'); } else { print_unescaped('" style="display: none'); } ?>"> |
| 127 | 127 | <?php if ($_['userAvatarSet']): ?> |
| 128 | 128 | <img alt="" width="32" height="32" |
| 129 | - src="<?php p(\OC::$server->getURLGenerator()->linkToRoute('core.avatar.getAvatar', ['userId' => $_['user_uid'], 'size' => 32, 'v' => $_['userAvatarVersion']]));?>" |
|
| 130 | - srcset="<?php p(\OC::$server->getURLGenerator()->linkToRoute('core.avatar.getAvatar', ['userId' => $_['user_uid'], 'size' => 64, 'v' => $_['userAvatarVersion']]));?> 2x, <?php p(\OC::$server->getURLGenerator()->linkToRoute('core.avatar.getAvatar', ['userId' => $_['user_uid'], 'size' => 128, 'v' => $_['userAvatarVersion']]));?> 4x" |
|
| 129 | + src="<?php p(\OC::$server->getURLGenerator()->linkToRoute('core.avatar.getAvatar', ['userId' => $_['user_uid'], 'size' => 32, 'v' => $_['userAvatarVersion']])); ?>" |
|
| 130 | + srcset="<?php p(\OC::$server->getURLGenerator()->linkToRoute('core.avatar.getAvatar', ['userId' => $_['user_uid'], 'size' => 64, 'v' => $_['userAvatarVersion']])); ?> 2x, <?php p(\OC::$server->getURLGenerator()->linkToRoute('core.avatar.getAvatar', ['userId' => $_['user_uid'], 'size' => 128, 'v' => $_['userAvatarVersion']])); ?> 4x" |
|
| 131 | 131 | > |
| 132 | 132 | <?php endif; ?> |
| 133 | 133 | </div> |
@@ -135,11 +135,11 @@ discard block |
||
| 135 | 135 | </div> |
| 136 | 136 | <div id="expanddiv"> |
| 137 | 137 | <ul> |
| 138 | - <?php foreach($_['settingsnavigation'] as $entry):?> |
|
| 138 | + <?php foreach ($_['settingsnavigation'] as $entry):?> |
|
| 139 | 139 | <li> |
| 140 | 140 | <a href="<?php print_unescaped($entry['href']); ?>" |
| 141 | - <?php if( $entry["active"] ): ?> class="active"<?php endif; ?>> |
|
| 142 | - <img alt="" src="<?php print_unescaped($entry['icon'] . '?v=' . $_['versionHash']); ?>"> |
|
| 141 | + <?php if ($entry["active"]): ?> class="active"<?php endif; ?>> |
|
| 142 | + <img alt="" src="<?php print_unescaped($entry['icon'].'?v='.$_['versionHash']); ?>"> |
|
| 143 | 143 | <?php p($entry['name']) ?> |
| 144 | 144 | </a> |
| 145 | 145 | </li> |
@@ -36,377 +36,377 @@ |
||
| 36 | 36 | * @since 9.0.0 |
| 37 | 37 | */ |
| 38 | 38 | class EmptyContentSecurityPolicy { |
| 39 | - /** @var bool Whether inline JS snippets are allowed */ |
|
| 40 | - protected $inlineScriptAllowed = null; |
|
| 41 | - /** @var string Whether JS nonces should be used */ |
|
| 42 | - protected $useJsNonce = null; |
|
| 43 | - /** |
|
| 44 | - * @var bool Whether eval in JS scripts is allowed |
|
| 45 | - * TODO: Disallow per default |
|
| 46 | - * @link https://github.com/owncloud/core/issues/11925 |
|
| 47 | - */ |
|
| 48 | - protected $evalScriptAllowed = null; |
|
| 49 | - /** @var array Domains from which scripts can get loaded */ |
|
| 50 | - protected $allowedScriptDomains = null; |
|
| 51 | - /** |
|
| 52 | - * @var bool Whether inline CSS is allowed |
|
| 53 | - * TODO: Disallow per default |
|
| 54 | - * @link https://github.com/owncloud/core/issues/13458 |
|
| 55 | - */ |
|
| 56 | - protected $inlineStyleAllowed = null; |
|
| 57 | - /** @var array Domains from which CSS can get loaded */ |
|
| 58 | - protected $allowedStyleDomains = null; |
|
| 59 | - /** @var array Domains from which images can get loaded */ |
|
| 60 | - protected $allowedImageDomains = null; |
|
| 61 | - /** @var array Domains to which connections can be done */ |
|
| 62 | - protected $allowedConnectDomains = null; |
|
| 63 | - /** @var array Domains from which media elements can be loaded */ |
|
| 64 | - protected $allowedMediaDomains = null; |
|
| 65 | - /** @var array Domains from which object elements can be loaded */ |
|
| 66 | - protected $allowedObjectDomains = null; |
|
| 67 | - /** @var array Domains from which iframes can be loaded */ |
|
| 68 | - protected $allowedFrameDomains = null; |
|
| 69 | - /** @var array Domains from which fonts can be loaded */ |
|
| 70 | - protected $allowedFontDomains = null; |
|
| 71 | - /** @var array Domains from which web-workers and nested browsing content can load elements */ |
|
| 72 | - protected $allowedChildSrcDomains = null; |
|
| 73 | - |
|
| 74 | - /** |
|
| 75 | - * Whether inline JavaScript snippets are allowed or forbidden |
|
| 76 | - * @param bool $state |
|
| 77 | - * @return $this |
|
| 78 | - * @since 8.1.0 |
|
| 79 | - * @deprecated 10.0 CSP tokens are now used |
|
| 80 | - */ |
|
| 81 | - public function allowInlineScript($state = false) { |
|
| 82 | - $this->inlineScriptAllowed = $state; |
|
| 83 | - return $this; |
|
| 84 | - } |
|
| 85 | - |
|
| 86 | - /** |
|
| 87 | - * Use the according JS nonce |
|
| 88 | - * |
|
| 89 | - * @param string $nonce |
|
| 90 | - * @return $this |
|
| 91 | - * @since 11.0.0 |
|
| 92 | - */ |
|
| 93 | - public function useJsNonce($nonce) { |
|
| 94 | - $this->useJsNonce = $nonce; |
|
| 95 | - return $this; |
|
| 96 | - } |
|
| 97 | - |
|
| 98 | - /** |
|
| 99 | - * Whether eval in JavaScript is allowed or forbidden |
|
| 100 | - * @param bool $state |
|
| 101 | - * @return $this |
|
| 102 | - * @since 8.1.0 |
|
| 103 | - */ |
|
| 104 | - public function allowEvalScript($state = true) { |
|
| 105 | - $this->evalScriptAllowed = $state; |
|
| 106 | - return $this; |
|
| 107 | - } |
|
| 108 | - |
|
| 109 | - /** |
|
| 110 | - * Allows to execute JavaScript files from a specific domain. Use * to |
|
| 111 | - * allow JavaScript from all domains. |
|
| 112 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 113 | - * @return $this |
|
| 114 | - * @since 8.1.0 |
|
| 115 | - */ |
|
| 116 | - public function addAllowedScriptDomain($domain) { |
|
| 117 | - $this->allowedScriptDomains[] = $domain; |
|
| 118 | - return $this; |
|
| 119 | - } |
|
| 120 | - |
|
| 121 | - /** |
|
| 122 | - * Remove the specified allowed script domain from the allowed domains. |
|
| 123 | - * |
|
| 124 | - * @param string $domain |
|
| 125 | - * @return $this |
|
| 126 | - * @since 8.1.0 |
|
| 127 | - */ |
|
| 128 | - public function disallowScriptDomain($domain) { |
|
| 129 | - $this->allowedScriptDomains = array_diff($this->allowedScriptDomains, [$domain]); |
|
| 130 | - return $this; |
|
| 131 | - } |
|
| 132 | - |
|
| 133 | - /** |
|
| 134 | - * Whether inline CSS snippets are allowed or forbidden |
|
| 135 | - * @param bool $state |
|
| 136 | - * @return $this |
|
| 137 | - * @since 8.1.0 |
|
| 138 | - */ |
|
| 139 | - public function allowInlineStyle($state = true) { |
|
| 140 | - $this->inlineStyleAllowed = $state; |
|
| 141 | - return $this; |
|
| 142 | - } |
|
| 143 | - |
|
| 144 | - /** |
|
| 145 | - * Allows to execute CSS files from a specific domain. Use * to allow |
|
| 146 | - * CSS from all domains. |
|
| 147 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 148 | - * @return $this |
|
| 149 | - * @since 8.1.0 |
|
| 150 | - */ |
|
| 151 | - public function addAllowedStyleDomain($domain) { |
|
| 152 | - $this->allowedStyleDomains[] = $domain; |
|
| 153 | - return $this; |
|
| 154 | - } |
|
| 155 | - |
|
| 156 | - /** |
|
| 157 | - * Remove the specified allowed style domain from the allowed domains. |
|
| 158 | - * |
|
| 159 | - * @param string $domain |
|
| 160 | - * @return $this |
|
| 161 | - * @since 8.1.0 |
|
| 162 | - */ |
|
| 163 | - public function disallowStyleDomain($domain) { |
|
| 164 | - $this->allowedStyleDomains = array_diff($this->allowedStyleDomains, [$domain]); |
|
| 165 | - return $this; |
|
| 166 | - } |
|
| 167 | - |
|
| 168 | - /** |
|
| 169 | - * Allows using fonts from a specific domain. Use * to allow |
|
| 170 | - * fonts from all domains. |
|
| 171 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 172 | - * @return $this |
|
| 173 | - * @since 8.1.0 |
|
| 174 | - */ |
|
| 175 | - public function addAllowedFontDomain($domain) { |
|
| 176 | - $this->allowedFontDomains[] = $domain; |
|
| 177 | - return $this; |
|
| 178 | - } |
|
| 179 | - |
|
| 180 | - /** |
|
| 181 | - * Remove the specified allowed font domain from the allowed domains. |
|
| 182 | - * |
|
| 183 | - * @param string $domain |
|
| 184 | - * @return $this |
|
| 185 | - * @since 8.1.0 |
|
| 186 | - */ |
|
| 187 | - public function disallowFontDomain($domain) { |
|
| 188 | - $this->allowedFontDomains = array_diff($this->allowedFontDomains, [$domain]); |
|
| 189 | - return $this; |
|
| 190 | - } |
|
| 191 | - |
|
| 192 | - /** |
|
| 193 | - * Allows embedding images from a specific domain. Use * to allow |
|
| 194 | - * images from all domains. |
|
| 195 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 196 | - * @return $this |
|
| 197 | - * @since 8.1.0 |
|
| 198 | - */ |
|
| 199 | - public function addAllowedImageDomain($domain) { |
|
| 200 | - $this->allowedImageDomains[] = $domain; |
|
| 201 | - return $this; |
|
| 202 | - } |
|
| 203 | - |
|
| 204 | - /** |
|
| 205 | - * Remove the specified allowed image domain from the allowed domains. |
|
| 206 | - * |
|
| 207 | - * @param string $domain |
|
| 208 | - * @return $this |
|
| 209 | - * @since 8.1.0 |
|
| 210 | - */ |
|
| 211 | - public function disallowImageDomain($domain) { |
|
| 212 | - $this->allowedImageDomains = array_diff($this->allowedImageDomains, [$domain]); |
|
| 213 | - return $this; |
|
| 214 | - } |
|
| 215 | - |
|
| 216 | - /** |
|
| 217 | - * To which remote domains the JS connect to. |
|
| 218 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 219 | - * @return $this |
|
| 220 | - * @since 8.1.0 |
|
| 221 | - */ |
|
| 222 | - public function addAllowedConnectDomain($domain) { |
|
| 223 | - $this->allowedConnectDomains[] = $domain; |
|
| 224 | - return $this; |
|
| 225 | - } |
|
| 226 | - |
|
| 227 | - /** |
|
| 228 | - * Remove the specified allowed connect domain from the allowed domains. |
|
| 229 | - * |
|
| 230 | - * @param string $domain |
|
| 231 | - * @return $this |
|
| 232 | - * @since 8.1.0 |
|
| 233 | - */ |
|
| 234 | - public function disallowConnectDomain($domain) { |
|
| 235 | - $this->allowedConnectDomains = array_diff($this->allowedConnectDomains, [$domain]); |
|
| 236 | - return $this; |
|
| 237 | - } |
|
| 238 | - |
|
| 239 | - /** |
|
| 240 | - * From which domains media elements can be embedded. |
|
| 241 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 242 | - * @return $this |
|
| 243 | - * @since 8.1.0 |
|
| 244 | - */ |
|
| 245 | - public function addAllowedMediaDomain($domain) { |
|
| 246 | - $this->allowedMediaDomains[] = $domain; |
|
| 247 | - return $this; |
|
| 248 | - } |
|
| 249 | - |
|
| 250 | - /** |
|
| 251 | - * Remove the specified allowed media domain from the allowed domains. |
|
| 252 | - * |
|
| 253 | - * @param string $domain |
|
| 254 | - * @return $this |
|
| 255 | - * @since 8.1.0 |
|
| 256 | - */ |
|
| 257 | - public function disallowMediaDomain($domain) { |
|
| 258 | - $this->allowedMediaDomains = array_diff($this->allowedMediaDomains, [$domain]); |
|
| 259 | - return $this; |
|
| 260 | - } |
|
| 261 | - |
|
| 262 | - /** |
|
| 263 | - * From which domains objects such as <object>, <embed> or <applet> are executed |
|
| 264 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 265 | - * @return $this |
|
| 266 | - * @since 8.1.0 |
|
| 267 | - */ |
|
| 268 | - public function addAllowedObjectDomain($domain) { |
|
| 269 | - $this->allowedObjectDomains[] = $domain; |
|
| 270 | - return $this; |
|
| 271 | - } |
|
| 272 | - |
|
| 273 | - /** |
|
| 274 | - * Remove the specified allowed object domain from the allowed domains. |
|
| 275 | - * |
|
| 276 | - * @param string $domain |
|
| 277 | - * @return $this |
|
| 278 | - * @since 8.1.0 |
|
| 279 | - */ |
|
| 280 | - public function disallowObjectDomain($domain) { |
|
| 281 | - $this->allowedObjectDomains = array_diff($this->allowedObjectDomains, [$domain]); |
|
| 282 | - return $this; |
|
| 283 | - } |
|
| 284 | - |
|
| 285 | - /** |
|
| 286 | - * Which domains can be embedded in an iframe |
|
| 287 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 288 | - * @return $this |
|
| 289 | - * @since 8.1.0 |
|
| 290 | - */ |
|
| 291 | - public function addAllowedFrameDomain($domain) { |
|
| 292 | - $this->allowedFrameDomains[] = $domain; |
|
| 293 | - return $this; |
|
| 294 | - } |
|
| 295 | - |
|
| 296 | - /** |
|
| 297 | - * Remove the specified allowed frame domain from the allowed domains. |
|
| 298 | - * |
|
| 299 | - * @param string $domain |
|
| 300 | - * @return $this |
|
| 301 | - * @since 8.1.0 |
|
| 302 | - */ |
|
| 303 | - public function disallowFrameDomain($domain) { |
|
| 304 | - $this->allowedFrameDomains = array_diff($this->allowedFrameDomains, [$domain]); |
|
| 305 | - return $this; |
|
| 306 | - } |
|
| 307 | - |
|
| 308 | - /** |
|
| 309 | - * Domains from which web-workers and nested browsing content can load elements |
|
| 310 | - * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 311 | - * @return $this |
|
| 312 | - * @since 8.1.0 |
|
| 313 | - */ |
|
| 314 | - public function addAllowedChildSrcDomain($domain) { |
|
| 315 | - $this->allowedChildSrcDomains[] = $domain; |
|
| 316 | - return $this; |
|
| 317 | - } |
|
| 318 | - |
|
| 319 | - /** |
|
| 320 | - * Remove the specified allowed child src domain from the allowed domains. |
|
| 321 | - * |
|
| 322 | - * @param string $domain |
|
| 323 | - * @return $this |
|
| 324 | - * @since 8.1.0 |
|
| 325 | - */ |
|
| 326 | - public function disallowChildSrcDomain($domain) { |
|
| 327 | - $this->allowedChildSrcDomains = array_diff($this->allowedChildSrcDomains, [$domain]); |
|
| 328 | - return $this; |
|
| 329 | - } |
|
| 330 | - |
|
| 331 | - /** |
|
| 332 | - * Get the generated Content-Security-Policy as a string |
|
| 333 | - * @return string |
|
| 334 | - * @since 8.1.0 |
|
| 335 | - */ |
|
| 336 | - public function buildPolicy() { |
|
| 337 | - $policy = "default-src 'none';"; |
|
| 338 | - $policy .= "base-uri 'none';"; |
|
| 339 | - $policy .= "manifest-src 'self';"; |
|
| 340 | - |
|
| 341 | - if(!empty($this->allowedScriptDomains) || $this->inlineScriptAllowed || $this->evalScriptAllowed) { |
|
| 342 | - $policy .= 'script-src '; |
|
| 343 | - if(is_string($this->useJsNonce)) { |
|
| 344 | - $policy .= '\'nonce-'.base64_encode($this->useJsNonce).'\''; |
|
| 345 | - $allowedScriptDomains = array_flip($this->allowedScriptDomains); |
|
| 346 | - unset($allowedScriptDomains['\'self\'']); |
|
| 347 | - $this->allowedScriptDomains = array_flip($allowedScriptDomains); |
|
| 348 | - if(count($allowedScriptDomains) !== 0) { |
|
| 349 | - $policy .= ' '; |
|
| 350 | - } |
|
| 351 | - } |
|
| 352 | - if(is_array($this->allowedScriptDomains)) { |
|
| 353 | - $policy .= implode(' ', $this->allowedScriptDomains); |
|
| 354 | - } |
|
| 355 | - if($this->inlineScriptAllowed) { |
|
| 356 | - $policy .= ' \'unsafe-inline\''; |
|
| 357 | - } |
|
| 358 | - if($this->evalScriptAllowed) { |
|
| 359 | - $policy .= ' \'unsafe-eval\''; |
|
| 360 | - } |
|
| 361 | - $policy .= ';'; |
|
| 362 | - } |
|
| 363 | - |
|
| 364 | - if(!empty($this->allowedStyleDomains) || $this->inlineStyleAllowed) { |
|
| 365 | - $policy .= 'style-src '; |
|
| 366 | - if(is_array($this->allowedStyleDomains)) { |
|
| 367 | - $policy .= implode(' ', $this->allowedStyleDomains); |
|
| 368 | - } |
|
| 369 | - if($this->inlineStyleAllowed) { |
|
| 370 | - $policy .= ' \'unsafe-inline\''; |
|
| 371 | - } |
|
| 372 | - $policy .= ';'; |
|
| 373 | - } |
|
| 374 | - |
|
| 375 | - if(!empty($this->allowedImageDomains)) { |
|
| 376 | - $policy .= 'img-src ' . implode(' ', $this->allowedImageDomains); |
|
| 377 | - $policy .= ';'; |
|
| 378 | - } |
|
| 379 | - |
|
| 380 | - if(!empty($this->allowedFontDomains)) { |
|
| 381 | - $policy .= 'font-src ' . implode(' ', $this->allowedFontDomains); |
|
| 382 | - $policy .= ';'; |
|
| 383 | - } |
|
| 384 | - |
|
| 385 | - if(!empty($this->allowedConnectDomains)) { |
|
| 386 | - $policy .= 'connect-src ' . implode(' ', $this->allowedConnectDomains); |
|
| 387 | - $policy .= ';'; |
|
| 388 | - } |
|
| 389 | - |
|
| 390 | - if(!empty($this->allowedMediaDomains)) { |
|
| 391 | - $policy .= 'media-src ' . implode(' ', $this->allowedMediaDomains); |
|
| 392 | - $policy .= ';'; |
|
| 393 | - } |
|
| 394 | - |
|
| 395 | - if(!empty($this->allowedObjectDomains)) { |
|
| 396 | - $policy .= 'object-src ' . implode(' ', $this->allowedObjectDomains); |
|
| 397 | - $policy .= ';'; |
|
| 398 | - } |
|
| 399 | - |
|
| 400 | - if(!empty($this->allowedFrameDomains)) { |
|
| 401 | - $policy .= 'frame-src ' . implode(' ', $this->allowedFrameDomains); |
|
| 402 | - $policy .= ';'; |
|
| 403 | - } |
|
| 404 | - |
|
| 405 | - if(!empty($this->allowedChildSrcDomains)) { |
|
| 406 | - $policy .= 'child-src ' . implode(' ', $this->allowedChildSrcDomains); |
|
| 407 | - $policy .= ';'; |
|
| 408 | - } |
|
| 409 | - |
|
| 410 | - return rtrim($policy, ';'); |
|
| 411 | - } |
|
| 39 | + /** @var bool Whether inline JS snippets are allowed */ |
|
| 40 | + protected $inlineScriptAllowed = null; |
|
| 41 | + /** @var string Whether JS nonces should be used */ |
|
| 42 | + protected $useJsNonce = null; |
|
| 43 | + /** |
|
| 44 | + * @var bool Whether eval in JS scripts is allowed |
|
| 45 | + * TODO: Disallow per default |
|
| 46 | + * @link https://github.com/owncloud/core/issues/11925 |
|
| 47 | + */ |
|
| 48 | + protected $evalScriptAllowed = null; |
|
| 49 | + /** @var array Domains from which scripts can get loaded */ |
|
| 50 | + protected $allowedScriptDomains = null; |
|
| 51 | + /** |
|
| 52 | + * @var bool Whether inline CSS is allowed |
|
| 53 | + * TODO: Disallow per default |
|
| 54 | + * @link https://github.com/owncloud/core/issues/13458 |
|
| 55 | + */ |
|
| 56 | + protected $inlineStyleAllowed = null; |
|
| 57 | + /** @var array Domains from which CSS can get loaded */ |
|
| 58 | + protected $allowedStyleDomains = null; |
|
| 59 | + /** @var array Domains from which images can get loaded */ |
|
| 60 | + protected $allowedImageDomains = null; |
|
| 61 | + /** @var array Domains to which connections can be done */ |
|
| 62 | + protected $allowedConnectDomains = null; |
|
| 63 | + /** @var array Domains from which media elements can be loaded */ |
|
| 64 | + protected $allowedMediaDomains = null; |
|
| 65 | + /** @var array Domains from which object elements can be loaded */ |
|
| 66 | + protected $allowedObjectDomains = null; |
|
| 67 | + /** @var array Domains from which iframes can be loaded */ |
|
| 68 | + protected $allowedFrameDomains = null; |
|
| 69 | + /** @var array Domains from which fonts can be loaded */ |
|
| 70 | + protected $allowedFontDomains = null; |
|
| 71 | + /** @var array Domains from which web-workers and nested browsing content can load elements */ |
|
| 72 | + protected $allowedChildSrcDomains = null; |
|
| 73 | + |
|
| 74 | + /** |
|
| 75 | + * Whether inline JavaScript snippets are allowed or forbidden |
|
| 76 | + * @param bool $state |
|
| 77 | + * @return $this |
|
| 78 | + * @since 8.1.0 |
|
| 79 | + * @deprecated 10.0 CSP tokens are now used |
|
| 80 | + */ |
|
| 81 | + public function allowInlineScript($state = false) { |
|
| 82 | + $this->inlineScriptAllowed = $state; |
|
| 83 | + return $this; |
|
| 84 | + } |
|
| 85 | + |
|
| 86 | + /** |
|
| 87 | + * Use the according JS nonce |
|
| 88 | + * |
|
| 89 | + * @param string $nonce |
|
| 90 | + * @return $this |
|
| 91 | + * @since 11.0.0 |
|
| 92 | + */ |
|
| 93 | + public function useJsNonce($nonce) { |
|
| 94 | + $this->useJsNonce = $nonce; |
|
| 95 | + return $this; |
|
| 96 | + } |
|
| 97 | + |
|
| 98 | + /** |
|
| 99 | + * Whether eval in JavaScript is allowed or forbidden |
|
| 100 | + * @param bool $state |
|
| 101 | + * @return $this |
|
| 102 | + * @since 8.1.0 |
|
| 103 | + */ |
|
| 104 | + public function allowEvalScript($state = true) { |
|
| 105 | + $this->evalScriptAllowed = $state; |
|
| 106 | + return $this; |
|
| 107 | + } |
|
| 108 | + |
|
| 109 | + /** |
|
| 110 | + * Allows to execute JavaScript files from a specific domain. Use * to |
|
| 111 | + * allow JavaScript from all domains. |
|
| 112 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 113 | + * @return $this |
|
| 114 | + * @since 8.1.0 |
|
| 115 | + */ |
|
| 116 | + public function addAllowedScriptDomain($domain) { |
|
| 117 | + $this->allowedScriptDomains[] = $domain; |
|
| 118 | + return $this; |
|
| 119 | + } |
|
| 120 | + |
|
| 121 | + /** |
|
| 122 | + * Remove the specified allowed script domain from the allowed domains. |
|
| 123 | + * |
|
| 124 | + * @param string $domain |
|
| 125 | + * @return $this |
|
| 126 | + * @since 8.1.0 |
|
| 127 | + */ |
|
| 128 | + public function disallowScriptDomain($domain) { |
|
| 129 | + $this->allowedScriptDomains = array_diff($this->allowedScriptDomains, [$domain]); |
|
| 130 | + return $this; |
|
| 131 | + } |
|
| 132 | + |
|
| 133 | + /** |
|
| 134 | + * Whether inline CSS snippets are allowed or forbidden |
|
| 135 | + * @param bool $state |
|
| 136 | + * @return $this |
|
| 137 | + * @since 8.1.0 |
|
| 138 | + */ |
|
| 139 | + public function allowInlineStyle($state = true) { |
|
| 140 | + $this->inlineStyleAllowed = $state; |
|
| 141 | + return $this; |
|
| 142 | + } |
|
| 143 | + |
|
| 144 | + /** |
|
| 145 | + * Allows to execute CSS files from a specific domain. Use * to allow |
|
| 146 | + * CSS from all domains. |
|
| 147 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 148 | + * @return $this |
|
| 149 | + * @since 8.1.0 |
|
| 150 | + */ |
|
| 151 | + public function addAllowedStyleDomain($domain) { |
|
| 152 | + $this->allowedStyleDomains[] = $domain; |
|
| 153 | + return $this; |
|
| 154 | + } |
|
| 155 | + |
|
| 156 | + /** |
|
| 157 | + * Remove the specified allowed style domain from the allowed domains. |
|
| 158 | + * |
|
| 159 | + * @param string $domain |
|
| 160 | + * @return $this |
|
| 161 | + * @since 8.1.0 |
|
| 162 | + */ |
|
| 163 | + public function disallowStyleDomain($domain) { |
|
| 164 | + $this->allowedStyleDomains = array_diff($this->allowedStyleDomains, [$domain]); |
|
| 165 | + return $this; |
|
| 166 | + } |
|
| 167 | + |
|
| 168 | + /** |
|
| 169 | + * Allows using fonts from a specific domain. Use * to allow |
|
| 170 | + * fonts from all domains. |
|
| 171 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 172 | + * @return $this |
|
| 173 | + * @since 8.1.0 |
|
| 174 | + */ |
|
| 175 | + public function addAllowedFontDomain($domain) { |
|
| 176 | + $this->allowedFontDomains[] = $domain; |
|
| 177 | + return $this; |
|
| 178 | + } |
|
| 179 | + |
|
| 180 | + /** |
|
| 181 | + * Remove the specified allowed font domain from the allowed domains. |
|
| 182 | + * |
|
| 183 | + * @param string $domain |
|
| 184 | + * @return $this |
|
| 185 | + * @since 8.1.0 |
|
| 186 | + */ |
|
| 187 | + public function disallowFontDomain($domain) { |
|
| 188 | + $this->allowedFontDomains = array_diff($this->allowedFontDomains, [$domain]); |
|
| 189 | + return $this; |
|
| 190 | + } |
|
| 191 | + |
|
| 192 | + /** |
|
| 193 | + * Allows embedding images from a specific domain. Use * to allow |
|
| 194 | + * images from all domains. |
|
| 195 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 196 | + * @return $this |
|
| 197 | + * @since 8.1.0 |
|
| 198 | + */ |
|
| 199 | + public function addAllowedImageDomain($domain) { |
|
| 200 | + $this->allowedImageDomains[] = $domain; |
|
| 201 | + return $this; |
|
| 202 | + } |
|
| 203 | + |
|
| 204 | + /** |
|
| 205 | + * Remove the specified allowed image domain from the allowed domains. |
|
| 206 | + * |
|
| 207 | + * @param string $domain |
|
| 208 | + * @return $this |
|
| 209 | + * @since 8.1.0 |
|
| 210 | + */ |
|
| 211 | + public function disallowImageDomain($domain) { |
|
| 212 | + $this->allowedImageDomains = array_diff($this->allowedImageDomains, [$domain]); |
|
| 213 | + return $this; |
|
| 214 | + } |
|
| 215 | + |
|
| 216 | + /** |
|
| 217 | + * To which remote domains the JS connect to. |
|
| 218 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 219 | + * @return $this |
|
| 220 | + * @since 8.1.0 |
|
| 221 | + */ |
|
| 222 | + public function addAllowedConnectDomain($domain) { |
|
| 223 | + $this->allowedConnectDomains[] = $domain; |
|
| 224 | + return $this; |
|
| 225 | + } |
|
| 226 | + |
|
| 227 | + /** |
|
| 228 | + * Remove the specified allowed connect domain from the allowed domains. |
|
| 229 | + * |
|
| 230 | + * @param string $domain |
|
| 231 | + * @return $this |
|
| 232 | + * @since 8.1.0 |
|
| 233 | + */ |
|
| 234 | + public function disallowConnectDomain($domain) { |
|
| 235 | + $this->allowedConnectDomains = array_diff($this->allowedConnectDomains, [$domain]); |
|
| 236 | + return $this; |
|
| 237 | + } |
|
| 238 | + |
|
| 239 | + /** |
|
| 240 | + * From which domains media elements can be embedded. |
|
| 241 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 242 | + * @return $this |
|
| 243 | + * @since 8.1.0 |
|
| 244 | + */ |
|
| 245 | + public function addAllowedMediaDomain($domain) { |
|
| 246 | + $this->allowedMediaDomains[] = $domain; |
|
| 247 | + return $this; |
|
| 248 | + } |
|
| 249 | + |
|
| 250 | + /** |
|
| 251 | + * Remove the specified allowed media domain from the allowed domains. |
|
| 252 | + * |
|
| 253 | + * @param string $domain |
|
| 254 | + * @return $this |
|
| 255 | + * @since 8.1.0 |
|
| 256 | + */ |
|
| 257 | + public function disallowMediaDomain($domain) { |
|
| 258 | + $this->allowedMediaDomains = array_diff($this->allowedMediaDomains, [$domain]); |
|
| 259 | + return $this; |
|
| 260 | + } |
|
| 261 | + |
|
| 262 | + /** |
|
| 263 | + * From which domains objects such as <object>, <embed> or <applet> are executed |
|
| 264 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 265 | + * @return $this |
|
| 266 | + * @since 8.1.0 |
|
| 267 | + */ |
|
| 268 | + public function addAllowedObjectDomain($domain) { |
|
| 269 | + $this->allowedObjectDomains[] = $domain; |
|
| 270 | + return $this; |
|
| 271 | + } |
|
| 272 | + |
|
| 273 | + /** |
|
| 274 | + * Remove the specified allowed object domain from the allowed domains. |
|
| 275 | + * |
|
| 276 | + * @param string $domain |
|
| 277 | + * @return $this |
|
| 278 | + * @since 8.1.0 |
|
| 279 | + */ |
|
| 280 | + public function disallowObjectDomain($domain) { |
|
| 281 | + $this->allowedObjectDomains = array_diff($this->allowedObjectDomains, [$domain]); |
|
| 282 | + return $this; |
|
| 283 | + } |
|
| 284 | + |
|
| 285 | + /** |
|
| 286 | + * Which domains can be embedded in an iframe |
|
| 287 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 288 | + * @return $this |
|
| 289 | + * @since 8.1.0 |
|
| 290 | + */ |
|
| 291 | + public function addAllowedFrameDomain($domain) { |
|
| 292 | + $this->allowedFrameDomains[] = $domain; |
|
| 293 | + return $this; |
|
| 294 | + } |
|
| 295 | + |
|
| 296 | + /** |
|
| 297 | + * Remove the specified allowed frame domain from the allowed domains. |
|
| 298 | + * |
|
| 299 | + * @param string $domain |
|
| 300 | + * @return $this |
|
| 301 | + * @since 8.1.0 |
|
| 302 | + */ |
|
| 303 | + public function disallowFrameDomain($domain) { |
|
| 304 | + $this->allowedFrameDomains = array_diff($this->allowedFrameDomains, [$domain]); |
|
| 305 | + return $this; |
|
| 306 | + } |
|
| 307 | + |
|
| 308 | + /** |
|
| 309 | + * Domains from which web-workers and nested browsing content can load elements |
|
| 310 | + * @param string $domain Domain to whitelist. Any passed value needs to be properly sanitized. |
|
| 311 | + * @return $this |
|
| 312 | + * @since 8.1.0 |
|
| 313 | + */ |
|
| 314 | + public function addAllowedChildSrcDomain($domain) { |
|
| 315 | + $this->allowedChildSrcDomains[] = $domain; |
|
| 316 | + return $this; |
|
| 317 | + } |
|
| 318 | + |
|
| 319 | + /** |
|
| 320 | + * Remove the specified allowed child src domain from the allowed domains. |
|
| 321 | + * |
|
| 322 | + * @param string $domain |
|
| 323 | + * @return $this |
|
| 324 | + * @since 8.1.0 |
|
| 325 | + */ |
|
| 326 | + public function disallowChildSrcDomain($domain) { |
|
| 327 | + $this->allowedChildSrcDomains = array_diff($this->allowedChildSrcDomains, [$domain]); |
|
| 328 | + return $this; |
|
| 329 | + } |
|
| 330 | + |
|
| 331 | + /** |
|
| 332 | + * Get the generated Content-Security-Policy as a string |
|
| 333 | + * @return string |
|
| 334 | + * @since 8.1.0 |
|
| 335 | + */ |
|
| 336 | + public function buildPolicy() { |
|
| 337 | + $policy = "default-src 'none';"; |
|
| 338 | + $policy .= "base-uri 'none';"; |
|
| 339 | + $policy .= "manifest-src 'self';"; |
|
| 340 | + |
|
| 341 | + if(!empty($this->allowedScriptDomains) || $this->inlineScriptAllowed || $this->evalScriptAllowed) { |
|
| 342 | + $policy .= 'script-src '; |
|
| 343 | + if(is_string($this->useJsNonce)) { |
|
| 344 | + $policy .= '\'nonce-'.base64_encode($this->useJsNonce).'\''; |
|
| 345 | + $allowedScriptDomains = array_flip($this->allowedScriptDomains); |
|
| 346 | + unset($allowedScriptDomains['\'self\'']); |
|
| 347 | + $this->allowedScriptDomains = array_flip($allowedScriptDomains); |
|
| 348 | + if(count($allowedScriptDomains) !== 0) { |
|
| 349 | + $policy .= ' '; |
|
| 350 | + } |
|
| 351 | + } |
|
| 352 | + if(is_array($this->allowedScriptDomains)) { |
|
| 353 | + $policy .= implode(' ', $this->allowedScriptDomains); |
|
| 354 | + } |
|
| 355 | + if($this->inlineScriptAllowed) { |
|
| 356 | + $policy .= ' \'unsafe-inline\''; |
|
| 357 | + } |
|
| 358 | + if($this->evalScriptAllowed) { |
|
| 359 | + $policy .= ' \'unsafe-eval\''; |
|
| 360 | + } |
|
| 361 | + $policy .= ';'; |
|
| 362 | + } |
|
| 363 | + |
|
| 364 | + if(!empty($this->allowedStyleDomains) || $this->inlineStyleAllowed) { |
|
| 365 | + $policy .= 'style-src '; |
|
| 366 | + if(is_array($this->allowedStyleDomains)) { |
|
| 367 | + $policy .= implode(' ', $this->allowedStyleDomains); |
|
| 368 | + } |
|
| 369 | + if($this->inlineStyleAllowed) { |
|
| 370 | + $policy .= ' \'unsafe-inline\''; |
|
| 371 | + } |
|
| 372 | + $policy .= ';'; |
|
| 373 | + } |
|
| 374 | + |
|
| 375 | + if(!empty($this->allowedImageDomains)) { |
|
| 376 | + $policy .= 'img-src ' . implode(' ', $this->allowedImageDomains); |
|
| 377 | + $policy .= ';'; |
|
| 378 | + } |
|
| 379 | + |
|
| 380 | + if(!empty($this->allowedFontDomains)) { |
|
| 381 | + $policy .= 'font-src ' . implode(' ', $this->allowedFontDomains); |
|
| 382 | + $policy .= ';'; |
|
| 383 | + } |
|
| 384 | + |
|
| 385 | + if(!empty($this->allowedConnectDomains)) { |
|
| 386 | + $policy .= 'connect-src ' . implode(' ', $this->allowedConnectDomains); |
|
| 387 | + $policy .= ';'; |
|
| 388 | + } |
|
| 389 | + |
|
| 390 | + if(!empty($this->allowedMediaDomains)) { |
|
| 391 | + $policy .= 'media-src ' . implode(' ', $this->allowedMediaDomains); |
|
| 392 | + $policy .= ';'; |
|
| 393 | + } |
|
| 394 | + |
|
| 395 | + if(!empty($this->allowedObjectDomains)) { |
|
| 396 | + $policy .= 'object-src ' . implode(' ', $this->allowedObjectDomains); |
|
| 397 | + $policy .= ';'; |
|
| 398 | + } |
|
| 399 | + |
|
| 400 | + if(!empty($this->allowedFrameDomains)) { |
|
| 401 | + $policy .= 'frame-src ' . implode(' ', $this->allowedFrameDomains); |
|
| 402 | + $policy .= ';'; |
|
| 403 | + } |
|
| 404 | + |
|
| 405 | + if(!empty($this->allowedChildSrcDomains)) { |
|
| 406 | + $policy .= 'child-src ' . implode(' ', $this->allowedChildSrcDomains); |
|
| 407 | + $policy .= ';'; |
|
| 408 | + } |
|
| 409 | + |
|
| 410 | + return rtrim($policy, ';'); |
|
| 411 | + } |
|
| 412 | 412 | } |
@@ -338,72 +338,72 @@ |
||
| 338 | 338 | $policy .= "base-uri 'none';"; |
| 339 | 339 | $policy .= "manifest-src 'self';"; |
| 340 | 340 | |
| 341 | - if(!empty($this->allowedScriptDomains) || $this->inlineScriptAllowed || $this->evalScriptAllowed) { |
|
| 341 | + if (!empty($this->allowedScriptDomains) || $this->inlineScriptAllowed || $this->evalScriptAllowed) { |
|
| 342 | 342 | $policy .= 'script-src '; |
| 343 | - if(is_string($this->useJsNonce)) { |
|
| 343 | + if (is_string($this->useJsNonce)) { |
|
| 344 | 344 | $policy .= '\'nonce-'.base64_encode($this->useJsNonce).'\''; |
| 345 | 345 | $allowedScriptDomains = array_flip($this->allowedScriptDomains); |
| 346 | 346 | unset($allowedScriptDomains['\'self\'']); |
| 347 | 347 | $this->allowedScriptDomains = array_flip($allowedScriptDomains); |
| 348 | - if(count($allowedScriptDomains) !== 0) { |
|
| 348 | + if (count($allowedScriptDomains) !== 0) { |
|
| 349 | 349 | $policy .= ' '; |
| 350 | 350 | } |
| 351 | 351 | } |
| 352 | - if(is_array($this->allowedScriptDomains)) { |
|
| 352 | + if (is_array($this->allowedScriptDomains)) { |
|
| 353 | 353 | $policy .= implode(' ', $this->allowedScriptDomains); |
| 354 | 354 | } |
| 355 | - if($this->inlineScriptAllowed) { |
|
| 355 | + if ($this->inlineScriptAllowed) { |
|
| 356 | 356 | $policy .= ' \'unsafe-inline\''; |
| 357 | 357 | } |
| 358 | - if($this->evalScriptAllowed) { |
|
| 358 | + if ($this->evalScriptAllowed) { |
|
| 359 | 359 | $policy .= ' \'unsafe-eval\''; |
| 360 | 360 | } |
| 361 | 361 | $policy .= ';'; |
| 362 | 362 | } |
| 363 | 363 | |
| 364 | - if(!empty($this->allowedStyleDomains) || $this->inlineStyleAllowed) { |
|
| 364 | + if (!empty($this->allowedStyleDomains) || $this->inlineStyleAllowed) { |
|
| 365 | 365 | $policy .= 'style-src '; |
| 366 | - if(is_array($this->allowedStyleDomains)) { |
|
| 366 | + if (is_array($this->allowedStyleDomains)) { |
|
| 367 | 367 | $policy .= implode(' ', $this->allowedStyleDomains); |
| 368 | 368 | } |
| 369 | - if($this->inlineStyleAllowed) { |
|
| 369 | + if ($this->inlineStyleAllowed) { |
|
| 370 | 370 | $policy .= ' \'unsafe-inline\''; |
| 371 | 371 | } |
| 372 | 372 | $policy .= ';'; |
| 373 | 373 | } |
| 374 | 374 | |
| 375 | - if(!empty($this->allowedImageDomains)) { |
|
| 376 | - $policy .= 'img-src ' . implode(' ', $this->allowedImageDomains); |
|
| 375 | + if (!empty($this->allowedImageDomains)) { |
|
| 376 | + $policy .= 'img-src '.implode(' ', $this->allowedImageDomains); |
|
| 377 | 377 | $policy .= ';'; |
| 378 | 378 | } |
| 379 | 379 | |
| 380 | - if(!empty($this->allowedFontDomains)) { |
|
| 381 | - $policy .= 'font-src ' . implode(' ', $this->allowedFontDomains); |
|
| 380 | + if (!empty($this->allowedFontDomains)) { |
|
| 381 | + $policy .= 'font-src '.implode(' ', $this->allowedFontDomains); |
|
| 382 | 382 | $policy .= ';'; |
| 383 | 383 | } |
| 384 | 384 | |
| 385 | - if(!empty($this->allowedConnectDomains)) { |
|
| 386 | - $policy .= 'connect-src ' . implode(' ', $this->allowedConnectDomains); |
|
| 385 | + if (!empty($this->allowedConnectDomains)) { |
|
| 386 | + $policy .= 'connect-src '.implode(' ', $this->allowedConnectDomains); |
|
| 387 | 387 | $policy .= ';'; |
| 388 | 388 | } |
| 389 | 389 | |
| 390 | - if(!empty($this->allowedMediaDomains)) { |
|
| 391 | - $policy .= 'media-src ' . implode(' ', $this->allowedMediaDomains); |
|
| 390 | + if (!empty($this->allowedMediaDomains)) { |
|
| 391 | + $policy .= 'media-src '.implode(' ', $this->allowedMediaDomains); |
|
| 392 | 392 | $policy .= ';'; |
| 393 | 393 | } |
| 394 | 394 | |
| 395 | - if(!empty($this->allowedObjectDomains)) { |
|
| 396 | - $policy .= 'object-src ' . implode(' ', $this->allowedObjectDomains); |
|
| 395 | + if (!empty($this->allowedObjectDomains)) { |
|
| 396 | + $policy .= 'object-src '.implode(' ', $this->allowedObjectDomains); |
|
| 397 | 397 | $policy .= ';'; |
| 398 | 398 | } |
| 399 | 399 | |
| 400 | - if(!empty($this->allowedFrameDomains)) { |
|
| 401 | - $policy .= 'frame-src ' . implode(' ', $this->allowedFrameDomains); |
|
| 400 | + if (!empty($this->allowedFrameDomains)) { |
|
| 401 | + $policy .= 'frame-src '.implode(' ', $this->allowedFrameDomains); |
|
| 402 | 402 | $policy .= ';'; |
| 403 | 403 | } |
| 404 | 404 | |
| 405 | - if(!empty($this->allowedChildSrcDomains)) { |
|
| 406 | - $policy .= 'child-src ' . implode(' ', $this->allowedChildSrcDomains); |
|
| 405 | + if (!empty($this->allowedChildSrcDomains)) { |
|
| 406 | + $policy .= 'child-src '.implode(' ', $this->allowedChildSrcDomains); |
|
| 407 | 407 | $policy .= ';'; |
| 408 | 408 | } |
| 409 | 409 | |
