Investigate CSP on static resources

[LukasReschke]

From IRC with @Raydiation:

15:22:35 <AnybodyElse> Raydiation: Yes. Easy.
15:23:38 → th3fallen joined (~th3fallen@206.74.96.146)
15:23:45 <AnybodyElse> Raydiation: Though something like that could also bite us if somebody ships an insecure HTML file since it has no CSP if it is not processed by PHP. Maybe worth to check which magic we could use to detect that as well…
15:25:22 <Raydiation> AnybodyElse: why not enhance the apache config file
15:25:33 <AnybodyElse> Raydiation: We would need to detect if already one is set etc.
15:25:40 <Raydiation> hm, not possible?
15:25:42 <AnybodyElse> Raydiation: Possible that this is possibly, that is what needs research! ;-)
15:25:50 <AnybodyElse> but busy with other things as usual
15:25:56 <AnybodyElse> but I will create a ticket for me
15:26:01 <Raydiation> http://serverfault.com/questions/520477/set-header-in-apache-if-it-doesnt-already-exist

[PVince81]

9.0 ?