meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-01-31 11:37:14 +00:00
Code Issues Releases Wiki Activity

Set a strict CSP policy for downloaded attachments, thumbnails, and raw repository files(#38417).

Browse Source 
Patch by Holger Just.


git-svn-id: https://svn.redmine.org/redmine/trunk@22295 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA 2023-09-18 02:16:36 +00:00
parent 3de9413917
commit 4973c9014b
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/controllers/attachments_controller.rb
View File

@ -321,4 +321,9 @@ class AttachmentsController < ApplicationController
request.raw_post
end
end
def send_file(path, options={})
headers['content-security-policy'] = "default-src 'none'; style-src 'unsafe-inline'; sandbox"
super
end
end

5
app/controllers/repositories_controller.rb
View File

@ -431,6 +431,11 @@ class RepositoriesController < ApplicationController
end
end
def send_file(path, options={})
headers['content-security-policy'] = "default-src 'none'; style-src 'unsafe-inline'; sandbox"
super
end
def valid_name?(rev)
return true if rev.nil?
return true if REV_PARAM_RE.match?(rev)