YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Enforce CSP rules for real on webadmin

Browse source
This commit is contained in:
Alexandre Aubin 2020-04-29 01:07:07 +02:00
parent c0c026613f
commit 0fba21f924
3 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
data/templates/nginx/plain/yunohost_admin.conf.inc
View file

@ -6,6 +6,9 @@ location /yunohost/admin/ {
default_type text/html; default_type text/html;
index index.html; index index.html;
more_set_headers "Content-Security-Policy: upgrade-insecure-requests; default-src 'self'; connect-src 'self' https://raw.githubusercontent.com https://paste.yunohost.org wss://$host; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; object-src 'none';";
more_set_headers "Content-Security-Policy-Report-Only:";
# Short cache on handlebars templates # Short cache on handlebars templates
location ~* \.(?:ms)$ { location ~* \.(?:ms)$ {
expires 5m; expires 5m;

2
data/templates/nginx/security.conf.inc
View file

@ -22,7 +22,7 @@ ssl_prefer_server_ciphers off;
# https://wiki.mozilla.org/Security/Guidelines/Web_Security # https://wiki.mozilla.org/Security/Guidelines/Web_Security
# https://observatory.mozilla.org/ # https://observatory.mozilla.org/
more_set_headers "Content-Security-Policy : upgrade-insecure-requests"; more_set_headers "Content-Security-Policy : upgrade-insecure-requests";
more_set_headers "Content-Security-Policy-Report-Only : default-src https: data: wss: 'unsafe-inline' 'unsafe-eval' "; more_set_headers "Content-Security-Policy-Report-Only : default-src https: data: 'unsafe-inline' 'unsafe-eval' ";
more_set_headers "X-Content-Type-Options : nosniff"; more_set_headers "X-Content-Type-Options : nosniff";
more_set_headers "X-XSS-Protection : 1; mode=block"; more_set_headers "X-XSS-Protection : 1; mode=block";
more_set_headers "X-Download-Options : noopen"; more_set_headers "X-Download-Options : noopen";

1
data/templates/nginx/yunohost_admin.conf
View file

@ -22,7 +22,6 @@ server {
more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload"; more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";
more_set_headers "Referrer-Policy : 'same-origin'"; more_set_headers "Referrer-Policy : 'same-origin'";
more_set_headers "Content-Security-Policy : upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval'";
location / { location / {
return 302 https://$http_host/yunohost/admin; return 302 https://$http_host/yunohost/admin;