From 944476d059581da183b2fd4b0168e936bb4492f8 Mon Sep 17 00:00:00 2001 From: Frank Hochmuth Date: Mon, 22 Apr 2024 23:58:32 +0200 Subject: [PATCH] Update plugin.fpprotect.php The CSP directives should only apply to HTTPS and not to HTTP connections. --- fp-plugins/fpprotect/plugin.fpprotect.php | 27 ++++++++++++++--------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/fp-plugins/fpprotect/plugin.fpprotect.php b/fp-plugins/fpprotect/plugin.fpprotect.php index 607fee4..2e5466d 100644 --- a/fp-plugins/fpprotect/plugin.fpprotect.php +++ b/fp-plugins/fpprotect/plugin.fpprotect.php @@ -8,16 +8,21 @@ * Author URI: https://www.flatpress.org */ -// Content Security Policy rules for Youtube, Facebook and Vimeo embedded video / BBCode [video], embedded OSM -header('Content-Security-Policy: default-src https: data:; frame-src https: data:; base-uri \'self\'; font-src https: data:; script-src https: \'unsafe-inline\' \'unsafe-eval\' blob:; style-src https: \'unsafe-inline\'; img-src https: data: blob:; frame-ancestors \'self\'; manifest-src \'self\'; worker-src \'self\' blob:; connect-src https: blob:; media-src \'self\' blob:; child-src \'self\' blob:; form-action \'self\'; object-src \'self\''); -header('X-Content-Security-Policy: default-src https: data:; frame-src https: data:; base-uri \'self\'; font-src https: data:; script-src https: \'unsafe-inline\' \'unsafe-eval\' blob:; style-src https: \'unsafe-inline\'; img-src https: data: blob:; frame-ancestors \'self\'; manifest-src \'self\'; worker-src \'self\' blob:; connect-src https: blob:; media-src \'self\' blob:; child-src \'self\' blob:; form-action \'self\'; object-src \'self\''); -header('X-WebKit-CSP: default-src https: data:; frame-src https: data:; base-uri \'self\'; font-src https: data:; script-src https: \'unsafe-inline\' \'unsafe-eval\' blob:; style-src https: \'unsafe-inline\'; img-src https: data: blob:; frame-ancestors \'self\'; manifest-src \'self\'; worker-src \'self\' blob:; connect-src https: blob:; media-src \'self\' blob:; child-src \'self\' blob:; form-action \'self\'; object-src \'self\''); +if (function_exists('is_https')) { -// End of Content Security Policy rules -header('Permissions-Policy: interest-cohort=(), autoplay=(self), camera=(self), fullscreen=*, geolocation=(self), microphone=(self), payment=()'); -header('Referrer-Policy: strict-origin-when-cross-origin'); -header('Strict-Transport-Security: max-age=15552000; includeSubDomains'); -header('X-Permitted-Cross-Domain-Policies: none'); -header('X-Download-Options: noopen'); + if (is_https()) { + // Content Security Policy rules for Youtube, Facebook and Vimeo embedded video / BBCode [video], embedded OSM + header('Content-Security-Policy: default-src https: data:; frame-src https: data:; base-uri \'self\'; font-src https: data:; script-src https: \'unsafe-inline\' \'unsafe-eval\' blob:; style-src https: \'unsafe-inline\'; img-src https: data: blob:; frame-ancestors \'self\'; manifest-src \'self\'; worker-src \'self\' blob:; connect-src https: blob:; media-src \'self\' blob:; child-src \'self\' blob:; form-action \'self\'; object-src \'self\''); + header('X-Content-Security-Policy: default-src https: data:; frame-src https: data:; base-uri \'self\'; font-src https: data:; script-src https: \'unsafe-inline\' \'unsafe-eval\' blob:; style-src https: \'unsafe-inline\'; img-src https: data: blob:; frame-ancestors \'self\'; manifest-src \'self\'; worker-src \'self\' blob:; connect-src https: blob:; media-src \'self\' blob:; child-src \'self\' blob:; form-action \'self\'; object-src \'self\''); + header('X-WebKit-CSP: default-src https: data:; frame-src https: data:; base-uri \'self\'; font-src https: data:; script-src https: \'unsafe-inline\' \'unsafe-eval\' blob:; style-src https: \'unsafe-inline\'; img-src https: data: blob:; frame-ancestors \'self\'; manifest-src \'self\'; worker-src \'self\' blob:; connect-src https: blob:; media-src \'self\' blob:; child-src \'self\' blob:; form-action \'self\'; object-src \'self\''); + + // End of Content Security Policy rules + header('Permissions-Policy: interest-cohort=(), autoplay=(self), camera=(self), fullscreen=*, geolocation=(self), microphone=(self), payment=()'); + header('Referrer-Policy: strict-origin-when-cross-origin'); + header('Strict-Transport-Security: max-age=15552000; includeSubDomains'); + header('X-Permitted-Cross-Domain-Policies: none'); + header('X-Download-Options: noopen'); + } + +} ?> -