View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/C4/Output.pm (-1 / +23 lines)
Lines 268-273 sub output_with_http_headers { Link Here
268
        'Cache-Control'   => $cache_policy,
268
        'Cache-Control'   => $cache_policy,
269
        'X-Frame-Options' => 'SAMEORIGIN',
269
        'X-Frame-Options' => 'SAMEORIGIN',
270
    };
270
    };
271
272
    my $csp_header;
273
    my $interface = C4::Context->interface;
274
    if ($interface){
275
        if ($interface eq 'opac'){
276
            #NOTE: See BZ 20397 for more information, especially about nonces
277
            #TODO: Replace hard-coded policy with one that can be configured from config file and/or UI
278
            my @csp_options_opac = (
279
                q#default-src 'self'#,
280
                q#img-src 'self' data:#,
281
                q#style-src 'self' 'unsafe-inline'#, #TODO: remove inline styles from Koha!
282
            );
283
            $csp_header = join('; ',@csp_options_opac);
284
        }
285
        #TODO: Add header for staff interface
286
    }
287
288
    if ($csp_header){
289
        #TODO: Toggle between "Content-Security-Policy" and "Content-Security-Policy-Report-Only"
290
        #based on system preference ContentSecurityPolicy (None/ReportOnly/Enforce) or koha-conf.xml config
291
        $options->{'Content-Security-Policy-Report-Only'} = $csp_header;
292
    }
293
271
    $options->{expires} = 'now' if $extra_options->{force_no_caching};
294
    $options->{expires} = 'now' if $extra_options->{force_no_caching};
272
    $options->{'Access-Control-Allow-Origin'} = C4::Context->preference('AccessControlAllowOrigin')
295
    $options->{'Access-Control-Allow-Origin'} = C4::Context->preference('AccessControlAllowOrigin')
273
        if C4::Context->preference('AccessControlAllowOrigin');
296
        if C4::Context->preference('AccessControlAllowOrigin');
274
- 

Return to bug 38365