mirror/php-adminer
1
0
Fork 0
mirror of https://github.com/vrana/adminer.git synced 2025-08-09 16:17:48 +02:00
Code Issues Releases Wiki Activity

Disallow scripts without nonce

Browse Source
This commit is contained in:
Jakub Vrana
2018-01-13 22:17:00 +01:00
parent e23da5da0e
commit 80d030f51a
9 changed files with 32 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
adminer/include/design.inc.php
View File

@@ -33,7 +33,7 @@ function page_header($title, $error = "", $breadcrumb = array(), $title2 = "") {
<?php } ?>
<body class="<?php echo lang('ltr'); ?> nojs">
<script>
<script<?php echo nonce(); ?>>
mixin(document.body, {onkeydown: bodyKeydown, onclick: bodyClick<?php echo (isset($_COOKIE["adminer_version"]) ? "" : ", onload: partial(verifyVersion, '$VERSION')"); ?>});
document.body.className = document.body.className.replace(/ nojs/, ' js');
var offlineMessage = '<?php echo js_escape(lang('You are offline.')); ?>';
@@ -109,7 +109,7 @@ function page_headers() {
function csp() {
return array(
"default-src" => "'none'",
"script-src" => "'self' 'unsafe-inline'",
"script-src" => "'self' 'unsafe-inline' 'nonce-" . get_nonce() . "' 'strict-dynamic'", // 'self' is a fallback for browsers not supporting 'strict-dynamic', 'unsafe-inline' is a fallback for browsers not supporting 'nonce-'
"style-src" => "'self' 'unsafe-inline'",
"connect-src" => "'self'",
"img-src" => "'self' data:",
@@ -118,6 +118,17 @@ function csp() {
);
}
/** Get a CSP nonce
* @return string Base64 value
*/
function get_nonce() {
static $nonce;
if (!$nonce) {
$nonce = base64_encode(rand_string());
}
return $nonce;
}
/** Print flash and error messages
* @param string
* @return null