|
Lines 268-273
sub output_with_http_headers {
Link Here
|
| 268 |
'Cache-Control' => $cache_policy, |
268 |
'Cache-Control' => $cache_policy, |
| 269 |
'X-Frame-Options' => 'SAMEORIGIN', |
269 |
'X-Frame-Options' => 'SAMEORIGIN', |
| 270 |
}; |
270 |
}; |
|
|
271 |
|
| 272 |
my $csp_header; |
| 273 |
my $interface = C4::Context->interface; |
| 274 |
if ($interface){ |
| 275 |
if ($interface eq 'opac'){ |
| 276 |
#NOTE: See BZ 20397 for more information, especially about nonces |
| 277 |
#TODO: Replace hard-coded policy with one that can be configured from config file and/or UI |
| 278 |
my @csp_options_opac = ( |
| 279 |
q#default-src 'self'#, |
| 280 |
q#img-src 'self' data:#, |
| 281 |
q#style-src 'self' 'unsafe-inline'#, #TODO: remove inline styles from Koha! |
| 282 |
); |
| 283 |
$csp_header = join('; ',@csp_options_opac); |
| 284 |
} |
| 285 |
#TODO: Add header for staff interface |
| 286 |
} |
| 287 |
|
| 288 |
if ($csp_header){ |
| 289 |
#TODO: Toggle between "Content-Security-Policy" and "Content-Security-Policy-Report-Only" |
| 290 |
#based on system preference ContentSecurityPolicy (None/ReportOnly/Enforce) or koha-conf.xml config |
| 291 |
$options->{'Content-Security-Policy-Report-Only'} = $csp_header; |
| 292 |
} |
| 293 |
|
| 271 |
$options->{expires} = 'now' if $extra_options->{force_no_caching}; |
294 |
$options->{expires} = 'now' if $extra_options->{force_no_caching}; |
| 272 |
$options->{'Access-Control-Allow-Origin'} = C4::Context->preference('AccessControlAllowOrigin') |
295 |
$options->{'Access-Control-Allow-Origin'} = C4::Context->preference('AccessControlAllowOrigin') |
| 273 |
if C4::Context->preference('AccessControlAllowOrigin'); |
296 |
if C4::Context->preference('AccessControlAllowOrigin'); |
| 274 |
- |
|
|