Set Content-Security-Policy header to disallow scripts

parent ba2bdf48
;;; Copyright 2011 Andrey Moskvitin <archimag@gmail.com>
;;; Copyright 2012 Vladimir Sedach <vsedach@common-lisp.net>
;;; Copyright 2012, 2019 Vladimir Sedach <vsedach@common-lisp.net>
;;; SPDX-License-Identifier: AGPL-3.0-or-later
......@@ -29,6 +29,8 @@
(defmethod acceptor-dispatch-request ((acceptor cliki2-acceptor) request)
(let* ((host (subseq (host) 0 (or (position #\: (host)) (length (host)))))
(*wiki* (cadr (assoc host (wikis acceptor) :test #'string=))))
(setf (header-out "Content-Security-Policy")
"default-src 'none'; style-src 'self' 'unsafe-inline'; img-src *; form-action 'self';")
(if *wiki*
(let ((*account* (account-auth)))
(loop for dispatcher in (dispatch-table acceptor)
......
;;; Copyright 2011 Andrey Moskvitin <archimag@gmail.com>
;;; Copyright 2011, 2012 Vladimir Sedach <vsedach@common-lisp.net>
;;; Copyright 2011, 2012, 2019 Vladimir Sedach <vsedach@common-lisp.net>
;;; SPDX-License-Identifier: AGPL-3.0-or-later
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment