diff --git a/web/includes/Group.php b/web/includes/Group.php index 82c1daba9..89849309b 100644 --- a/web/includes/Group.php +++ b/web/includes/Group.php @@ -188,7 +188,7 @@ class Group { session_write_close(); return htmlSelect( 'Group[]', Group::get_dropdown_options(), isset($_SESSION['Group'])?$_SESSION['Group']:null, array( - 'onchange' => 'this.form.submit();', + 'data-on-change' => 'submitThisForm', 'class'=>'chosen', 'multiple'=>'multiple', 'data-placeholder'=>'All', diff --git a/web/includes/functions.php b/web/includes/functions.php index cd278ba79..6473be91b 100644 --- a/web/includes/functions.php +++ b/web/includes/functions.php @@ -35,6 +35,28 @@ function noCacheHeaders() { header('Pragma: no-cache'); // HTTP/1.0 } +function CSPHeaders($view, $nonce) { + switch ($view) { + case "bandwidth": + case "function": + case "log": + case "logout": + case "options": + case "version": { + // Enforce script-src on pages where inline scripts and event handlers have been fixed. + // 'unsafe-inline' is only for backwards compatibility with browsers which + // only support CSP 1 (with no nonce-* support). + header("Content-Security-Policy: script-src 'unsafe-inline' 'self' 'nonce-$nonce'"); + break; + } + default: { + // Use Report-Only mode on all other pages. + header("Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'self' 'nonce-$nonce'"); + break; + } + } +} + function CORSHeaders() { if ( isset($_SERVER['HTTP_ORIGIN']) ) { diff --git a/web/index.php b/web/index.php index d9677d146..29e67d628 100644 --- a/web/index.php +++ b/web/index.php @@ -172,6 +172,10 @@ $view = null; if ( isset($_REQUEST['view']) ) $view = detaintPath($_REQUEST['view']); +# Add CSP Headers +$cspNonce = bin2hex(openssl_random_pseudo_bytes(16)); +CSPHeaders($view, $cspNonce); + $request = null; if ( isset($_REQUEST['request']) ) $request = detaintPath($_REQUEST['request']); diff --git a/web/skins/classic/includes/export_functions.php b/web/skins/classic/includes/export_functions.php index 7750f165b..eb505f18b 100644 --- a/web/skins/classic/includes/export_functions.php +++ b/web/skins/classic/includes/export_functions.php @@ -263,12 +263,12 @@ function exportEventImages( $event, $exportDetail, $exportFrames, $myfilelist )

- +
 
diff --git a/web/skins/classic/includes/functions.php b/web/skins/classic/includes/functions.php index e39c56b4a..535d8ba31 100644 --- a/web/skins/classic/includes/functions.php +++ b/web/skins/classic/includes/functions.php @@ -120,7 +120,7 @@ echo output_link_if_exists( array( -