Added HTTP CSP headers.
Ylian Saint-Hilaire committed
Jan 10, 2020 at 17:04 UTC
4f8862b1131ea11ba087a80149a1eed898ee2602
2 files changed
+2
-2
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.7-h",
3
+ "version": "0.4.7-i",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+1
-1
@@ -3410,7 +3410,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3410
'Referrer-Policy': 'no-referrer',
3411
'X-XSS-Protection': '1; mode=block',
3412
'X-Content-Type-Options': 'nosniff',
3413
- 'Content-Security-Policy': "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'" + geourl + selfurl + "; img-src 'self'" + geourl + " data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"
3413
+ 'Content-Security-Policy': "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'" + geourl + selfurl + "; img-src 'self'" + geourl + " data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'; base-url: 'none'; form-action 'self'"
3414
};
3415
if ((parent.config.settings.allowframing !== true) && (typeof parent.config.settings.allowframing !== 'string')) { headers['X-Frame-Options'] = 'sameorigin'; }
3416
res.set(headers);