Commit 32112369 authored by Christophe Maudoux's avatar Christophe Maudoux

Set default formAction CSP (#1499)

parent 304216bd
......@@ -33,7 +33,7 @@ sub defaultValues {
'cspConnect' => '\'self\'',
'cspDefault' => '\'self\'',
'cspFont' => '\'self\'',
'cspFormAction' => '*',
'cspFormAction' => '\'self\'',
'cspImg' => '\'self\' data:',
'cspScript' => '\'self\'',
'cspStyle' => '\'self\'',
......
......@@ -920,7 +920,7 @@ qr/(?:(?:https?):\/\/(?:(?:(?:(?:(?:(?:[a-zA-Z0-9][-a-zA-Z0-9]*)?[a-zA-Z0-9])[.]
'type' => 'text'
},
'cspFormAction' => {
'default' => '*',
'default' => '\'self\'',
'type' => 'text'
},
'cspImg' => {
......
......@@ -615,7 +615,7 @@ sub attributes {
},
cspFormAction => {
type => 'text',
default => "*",
default => "'self'",
documentation => 'Form action destination for Content-Security-Policy',
},
cspImg => {
......
This source diff could not be displayed because it is too large. You can view the blob instead.
......@@ -723,7 +723,7 @@ sub sendHtml {
# Set authorized URL for POST
my $csp
= $self->csp . "form-action 'self' " . $self->conf->{cspFormAction};
= $self->csp . "form-action " . $self->conf->{cspFormAction};
if ( my $url = $req->urldc ) {
$self->logger->debug("Required urldc : $url");
$url =~ s#(https?://[^/]+).*#$1#;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment