From 6574ec2d443d4c1652bf6ebc1b181cf1327f6248 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Fri, 18 Dec 2020 14:29:17 -0800 Subject: [PATCH] apache2: Disallow all inline styling in sandbox settings Signed-off-by: Sunil Mohan Adapa Reviewed-by: Veiko Aasa --- data/etc/apache2/conf-available/freedombox.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/etc/apache2/conf-available/freedombox.conf b/data/etc/apache2/conf-available/freedombox.conf index 7bf713dbf..893eb32ff 100644 --- a/data/etc/apache2/conf-available/freedombox.conf +++ b/data/etc/apache2/conf-available/freedombox.conf @@ -46,7 +46,7 @@ RedirectMatch "^/freedombox" "/plinth" ## Header set Referrer-Policy 'same-origin' - Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-forms allow-same-origin; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" + Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-forms allow-same-origin; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" Header set X-Content-Type-Options 'nosniff'