Csp: Include `script-src 'self';

fixes #5180
2024-02-02 14:06:39 +01:00 · 2024-02-02 14:06:39 +01:00 · 4c3139224e
parent fa394c8895
commit 4c3139224e
1 changed files with 5 additions and 1 deletions
--- a/library/Icinga/Util/Csp.php
+++ b/library/Icinga/Util/Csp.php
@ -51,7 +51,11 @@ class Csp
            throw new RuntimeException('No nonce set for CSS');
        }

-        $response->setHeader('Content-Security-Policy', "style-src 'self' 'nonce-$csp->styleNonce';", true);
+        $response->setHeader(
+            'Content-Security-Policy',
+            "script-src 'self'; style-src 'self' 'nonce-$csp->styleNonce';",
+            true
+        );
    }

    /**