From 9965529fd4079ea6db894000fb384c34e8ee26d4 Mon Sep 17 00:00:00 2001 From: Pontoporeia Date: Fri, 10 Jul 2026 17:22:11 +0200 Subject: [PATCH] nginx: open CSP frame-src from hardcoded domain whitelist to https: scheme-wide --- TODO.md | 1 + nginx/xamxam.conf | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/TODO.md b/TODO.md index 5ece18e..01a14dc 100644 --- a/TODO.md +++ b/TODO.md @@ -1,5 +1,6 @@ # TODO +- [x] Open up CSP frame-src from hardcoded domain whitelist to `https:` scheme-wide - [x] Fix relinked file not appearing in FilePond UI: switch to ID-based input lookup - [x] Fix student name popover overflowing below viewport: clamp position so popover stays within screen bounds - [x] Fix orientation (and other filter) metadata links on TFE page leading to empty search: remove redundant `query=` param diff --git a/nginx/xamxam.conf b/nginx/xamxam.conf index ad6f82b..264a4d8 100644 --- a/nginx/xamxam.conf +++ b/nginx/xamxam.conf @@ -56,7 +56,7 @@ server { # Security headers add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload;" always; - add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; + add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; add_header X-Frame-Options "DENY" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; @@ -145,7 +145,7 @@ server { # script-src needs 'unsafe-inline' for the OverType editor init block # and the live-reload poller (dev only). Admin is already auth-gated. # 'unsafe-eval' is required by htmx (uses Function() internally). - add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; + add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always; # Disable directory listing autoindex off; @@ -190,7 +190,7 @@ server { # try_files triggers an internal redirect to location = /index.php, which # loses this CSP override and inherits the server-block frame-ancestors 'none'. location = /media { - add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always; + add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always; # Direct fastcgi_pass to /index.php (no try_files) so add_header survives. # We can't use snippets/fastcgi-php.conf because its try_files # $fastcgi_script_name =404 would fail — $fastcgi_script_name is /media