Repository: openmeetings Updated Branches: refs/heads/3.3.x f4f33fe2b -> 66efad90b
no jira: default value for Content-Security-Policy header is fixed Project: http://git-wip-us.apache.org/repos/asf/openmeetings/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings/commit/66efad90 Tree: http://git-wip-us.apache.org/repos/asf/openmeetings/tree/66efad90 Diff: http://git-wip-us.apache.org/repos/asf/openmeetings/diff/66efad90 Branch: refs/heads/3.3.x Commit: 66efad90bb76f919ea39f8ac7712c6a5656ac4e4 Parents: f4f33fe Author: Maxim Solodovnik <[email protected]> Authored: Wed May 17 00:54:04 2017 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Wed May 17 00:54:04 2017 +0700 ---------------------------------------------------------------------- .../org/apache/openmeetings/installation/ImportInitvalues.java | 2 +- openmeetings-server/src/site/xdoc/GeneralConfiguration.xml | 2 +- .../java/org/apache/openmeetings/util/OpenmeetingsVariables.java | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings/blob/66efad90/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java ---------------------------------------------------------------------- diff --git a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java index 9275e07..e7099b9 100644 --- a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java +++ b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java @@ -357,7 +357,7 @@ public class ImportInitvalues { cfgDao.add(CONFIG_CALENDAR_FIRST_DAY, "0", null, "The day that each week begins. The value must be a number that represents the day of the week. Sunday=0, Monday=1, Tuesday=2, etc."); cfgDao.add(CONFIG_GOOGLE_ANALYTICS_CODE, null, null, "Code for Google Analytics"); cfgDao.add(CONFIG_HEADER_XFRAME, HEADER_XFRAME_SAMEORIGIN, null, "Value for 'X-Frame-Options' header (default: DENY), more info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options";); - cfgDao.add(CONFIG_HEADER_CSP, HEADER_CSP_SELF, null, "Value for 'Content-Security-Policy' header (default: default-src 'self';), have to be modified to enable Google analytics site: https://content-security-policy.com/";); + cfgDao.add(CONFIG_HEADER_CSP, HEADER_CSP_SELF, null, "Value for 'Content-Security-Policy' header (default: default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';), have to be modified to enable Google analytics site: https://content-security-policy.com/";); log.debug("Configurations ADDED"); } http://git-wip-us.apache.org/repos/asf/openmeetings/blob/66efad90/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml ---------------------------------------------------------------------- diff --git a/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml b/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml index 63338f8..542bdd2 100644 --- a/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml +++ b/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml @@ -303,7 +303,7 @@ </tr> <tr> <td> header.content.security.policy </td> - <td> default-src 'self'; </td> + <td> default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; </td> <td> Value for 'Content-Security-Policy' header, have to be modified to enable Google analytics site: https://content-security-policy.com/ </td> <td> 3.3.0 </td> </tr> http://git-wip-us.apache.org/repos/asf/openmeetings/blob/66efad90/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java ---------------------------------------------------------------------- diff --git a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java index 32eecae..6fa19d9 100644 --- a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java +++ b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java @@ -51,7 +51,7 @@ public class OpenmeetingsVariables { public static final String CONFIG_IMAGEMAGIC_PATH = "imagemagick_path"; public static final String CONFIG_HEADER_XFRAME = "header.x.frame.options"; public static final String HEADER_XFRAME_SAMEORIGIN = "SAMEORIGIN"; - public static final String HEADER_CSP_SELF = "default-src 'self';"; + public static final String HEADER_CSP_SELF = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"; public static final String CONFIG_HEADER_CSP = "header.content.security.policy"; public static final String MENU_ROOMS_NAME = "Conference Rooms"; public static final int RECENT_ROOMS_COUNT = 5;
