From dfe9e3fb2e063a0cf4ab4849a4329f05cb6255b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Calvi=C3=B1o=20S=C3=A1nchez?= Date: Wed, 10 Apr 2019 16:46:19 +0200 Subject: [PATCH] Do not allow JavaScript "eval" in the public share auth page with Talk MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Talk no longer uses JavaScript "eval", so the Content Security Policy can now be configured to prevent its use in the public share authentication page when the password is protected by Talk. Signed-off-by: Daniel Calviño Sánchez --- apps/files_sharing/lib/Controller/ShareController.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/apps/files_sharing/lib/Controller/ShareController.php b/apps/files_sharing/lib/Controller/ShareController.php index 99685f671d3ec..3bd65cd3974b1 100644 --- a/apps/files_sharing/lib/Controller/ShareController.php +++ b/apps/files_sharing/lib/Controller/ShareController.php @@ -164,7 +164,6 @@ public function showAuthenticate(): TemplateResponse { $csp = new ContentSecurityPolicy(); $csp->addAllowedConnectDomain('*'); $csp->addAllowedMediaDomain('blob:'); - $csp->allowEvalScript(true); $response->setContentSecurityPolicy($csp); } @@ -185,7 +184,6 @@ protected function showAuthFailed(): TemplateResponse { $csp = new ContentSecurityPolicy(); $csp->addAllowedConnectDomain('*'); $csp->addAllowedMediaDomain('blob:'); - $csp->allowEvalScript(true); $response->setContentSecurityPolicy($csp); }