Fix CSP errors in MantisGraph plugin (#881)

Fixes #21653
mantisbt · Sep 20, 2016 · bad2c14 · bad2c14
1 parent a272baf
commit bad2c14
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/plugins/MantisGraph/MantisGraph.php b/plugins/MantisGraph/MantisGraph.php
@@ -70,7 +70,21 @@ function hooks() {
 	 */
 	function csp_headers() {
 		if ( config_get_global( 'cdn_enabled' ) == ON ) {
-			http_csp_add( 'script-src', 'https://cdnjs.cloudflare.com/ajax/libs/Chart.js/' );
+			http_csp_add( 'script-src', 'https://cdnjs.cloudflare.com' );
+		}
+
+		# Enable inline scripts for MantisGraph plugin pages unless the need for inline
+		# scripts is removed.
+		$t_page = gpc_get_string( 'page', '' );
+		if ( !is_blank( $t_page ) ) {
+			$t_pos = stripos( $t_page, '/' );
+
+			if ( $t_pos !== false ) {
+				$t_page = substr( $t_page, $t_pos + 1 );
+				if ( $_SERVER['REQUEST_URI'] == plugin_page( $t_page ) ) {
+					http_csp_add( 'script-src', "'unsafe-inline'" );
+				}
+			}
 		}
 	}