nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-07-27 12:59:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add Content-Security-Policy header to sample Apache2 config files

Browse Source 
We now support running with a strict self CSP, let's provide that!
This commit is contained in:
Andrew Ruthven 2022-12-13 11:44:39 +13:00 committed by Andrew Ruthven
parent 35641b099a
commit ffe5ed24ad
3 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitlab-ci.yml
View File

@ -72,6 +72,7 @@ test:
- su postgres -c 'createuser testrunner --superuser'
- pg_ctlcluster 15 main restart
- a2enmod rewrite
- a2enmod headers
- apache2ctl start
- useradd testrunner
- cd testing && su testrunner -c 'IS_CI=yes ALLSUITES="regression-suite binding carddav scheduling" ./run_regressions.sh all x'
@ -131,6 +132,7 @@ test_bullseye_carddavclientinterop:
- su postgres -c 'createuser testrunner --superuser'
- pg_ctlcluster 13 main restart
- a2enmod rewrite
- a2enmod headers
- apache2ctl start
- useradd testrunner
- cd testing && su testrunner -c 'IS_CI=yes ALLSUITES="regression-suite binding carddav scheduling" ./run_regressions.sh all x'
@ -221,6 +223,7 @@ test_bullseye_latestphp:
- su postgres -c 'createuser testrunner --superuser'
- pg_ctlcluster 13 main restart
- a2enmod rewrite
- a2enmod headers
- a2dismod -f deflate
- apache2ctl start
- useradd testrunner

5
config/apache-davical.conf
View File

@ -49,3 +49,8 @@ Alias /davical /usr/share/davical/htdocs
# Everything else gets rewritten to /caldav.php/...
#RewriteRule ^(.*)$ /davical/caldav.php$1 [NC,L]
</IfModule>
# All content for our UI should be served locally.
<FilesMatch "(admin|help|iSchedule|index|metrics|public|setup|tools|upgrade).php">
Header set Content-Security-Policy "default-src 'none'; img-src 'self' data:; media-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' data:; font-src 'self' data:; object-src 'self'; base-uri 'self'; connect-src 'self'; form-action 'self' sis.redsys.es; frame-ancestors 'self'"
</FilesMatch>

7
testing/apache-site.conf.example
View File

@ -25,4 +25,9 @@ Listen 127.0.1.1:80
RewriteCond %{REQUEST_URI} !^/$
RewriteCond %{REQUEST_URI} !\.(php|css|png|gif|js|jpg|ico)
RewriteRule ^(.*)$ /caldav.php$1 [NC,L]
</VirtualHost>
# All content for our UI should be served locally.
<FilesMatch "(admin|help|iSchedule|index|metrics|public|setup|tools|upgrade).php">
Header set Content-Security-Policy "default-src 'none'; img-src 'self' data:; media-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' data:; font-src 'self' data:; object-src 'self'; base-uri 'self'; connect-src 'self'; form-action 'self' sis.redsys.es; frame-ancestors 'self'"
</FilesMatch>
</VirtualHost>