kenmirrors/firefly-iii
1
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2025-09-29 18:20:01 +00:00
Code Issues Projects Releases Wiki Activity

Code for #2920

Browse Source
This commit is contained in:
James Cole
2020-01-04 11:00:44 +01:00
parent cb575f3200
commit d83d8d3f97
12 changed files with 42 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/Http/Middleware/SecureHeaders.php
View File

@@ -34,20 +34,24 @@ use Illuminate\Support\Str;
class SecureHeaders
{
/**
* Handle an incoming request. May not be a limited user (ie. Sandstorm env. or demo user).
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @param \Closure $next
*
* @return mixed
* @throws \Exception
*/
public function handle(Request $request, Closure $next)
{
$nonce = base64_encode(random_bytes(16));
app('view')->share('JS_NONCE', $nonce);
$response = $next($request);
$google = '';
$googleImg = '';
$analyticsId = config('firefly.analytics_id');
$token = Str::random(16);
if ('' !== $analyticsId) {
$google = 'www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js'; // @codeCoverageIgnore
$googleImg = 'https://www.google-analytics.com/';
@@ -55,7 +59,7 @@ class SecureHeaders
$csp = [
"default-src 'none'",
"object-src 'self'",
sprintf("script-src 'self' 'unsafe-inline' %s", $google),
sprintf("script-src 'nonce-%s' %s", $nonce, $google),
"style-src 'self' 'unsafe-inline'",
"base-uri 'self'",
"font-src 'self' data:",