Repository: openmeetings Updated Branches: refs/heads/master 832167d56 -> fb8e34bfe
no jira: default value for Content-Security-Policy header is fixed Project: http://git-wip-us.apache.org/repos/asf/openmeetings/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings/commit/fb8e34bf Tree: http://git-wip-us.apache.org/repos/asf/openmeetings/tree/fb8e34bf Diff: http://git-wip-us.apache.org/repos/asf/openmeetings/diff/fb8e34bf Branch: refs/heads/master Commit: fb8e34bfe67a6822c05766a921a97142d8681630 Parents: 832167d Author: Maxim Solodovnik <[email protected]> Authored: Wed May 17 00:54:04 2017 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Wed May 17 00:54:46 2017 +0700 ---------------------------------------------------------------------- .../org/apache/openmeetings/installation/ImportInitvalues.java | 2 +- openmeetings-server/src/site/xdoc/GeneralConfiguration.xml | 2 +- .../java/org/apache/openmeetings/util/OpenmeetingsVariables.java | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings/blob/fb8e34bf/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java ---------------------------------------------------------------------- diff --git a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java index 44c5331..f99ea3b 100644 --- a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java +++ b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java @@ -366,7 +366,7 @@ public class ImportInitvalues { cfgDao.add(CONFIG_FLASH_VIDEO_FPS, "30", null, "Camera FPS, should be positive number in range (0, 60]"); cfgDao.add(CONFIG_HEADER_XFRAME, HEADER_XFRAME_SAMEORIGIN, null, "Value for 'X-Frame-Options' header (default: DENY), more info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options";); - cfgDao.add(CONFIG_HEADER_CSP, HEADER_CSP_SELF, null, "Value for 'Content-Security-Policy' header (default: default-src 'self';), have to be modified to enable Google analytics site: https://content-security-policy.com/";); + cfgDao.add(CONFIG_HEADER_CSP, HEADER_CSP_SELF, null, "Value for 'Content-Security-Policy' header (default: default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';), have to be modified to enable Google analytics site: https://content-security-policy.com/";); log.debug("Configurations ADDED"); } http://git-wip-us.apache.org/repos/asf/openmeetings/blob/fb8e34bf/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml ---------------------------------------------------------------------- diff --git a/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml b/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml index 31622aa..403e4b7 100644 --- a/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml +++ b/openmeetings-server/src/site/xdoc/GeneralConfiguration.xml @@ -303,7 +303,7 @@ </tr> <tr> <td> header.content.security.policy </td> - <td> default-src 'self'; </td> + <td> default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; </td> <td> Value for 'Content-Security-Policy' header, have to be modified to enable Google analytics site: https://content-security-policy.com/ </td> <td> 3.3.0 </td> </tr> http://git-wip-us.apache.org/repos/asf/openmeetings/blob/fb8e34bf/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java ---------------------------------------------------------------------- diff --git a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java index e314bfb..08f18ca 100644 --- a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java +++ b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OpenmeetingsVariables.java @@ -57,7 +57,7 @@ public class OpenmeetingsVariables { public static final String CONFIG_FLASH_VIDEO_FPS = "flash.video.fps"; public static final String CONFIG_HEADER_XFRAME = "header.x.frame.options"; public static final String HEADER_XFRAME_SAMEORIGIN = "SAMEORIGIN"; - public static final String HEADER_CSP_SELF = "default-src 'self';"; + public static final String HEADER_CSP_SELF = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"; public static final String CONFIG_HEADER_CSP = "header.content.security.policy"; public static final String MENU_ROOMS_NAME = "Conference Rooms"; public static final int RECENT_ROOMS_COUNT = 5;
