Merge pull request #34 from honzap/csp_3426500

Improve X-Content-Security-Policy header (BugID: 3426500)
phpmyadmin · Apr 16, 2012 · 30197b8 · 30197b8
2 parents 4d213ad + 1b36253
commit 30197b8
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php
@@ -22,7 +22,8 @@
 /* Prevent against ClickJacking by allowing frames only from same origin */
 if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) {
     header('X-Frame-Options: SAMEORIGIN');
-    header('X-Content-Security-Policy: allow \'self\'; options inline-script eval-script; frame-ancestors \'self\'; img-src \'self\' data:; script-src \'self\' www.phpmyadmin.net');
+    header('X-Content-Security-Policy: allow \'self\'; options inline-script eval-script; frame-ancestors \'self\'; img-src \'self\' data:; script-src \'self\' http://www.phpmyadmin.net');
+    header('X-WebKit-CSP: default-src \'self\' \'unsafe-inline\'; img-src \'self\' data:; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' http://www.phpmyadmin.net');
 }
 PMA_no_cache_header();
 if (!defined('IS_TRANSFORMATION_WRAPPER')) {