jrenslin/md-cms
Archived
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Improved settings of CSPs.

Browse Source 
Added manifest.json.
Added further security-related HTTP headers.
This commit is contained in:
Joshua Ramon Enslin
2018-06-18 13:57:35 +02:00
committed by Stefan Rohde-Enslin
parent 1acdc7ba2b
commit 067beedf29
12 changed files with 165 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
inc/functions.php
View File

@ -74,19 +74,28 @@ function ensureEnvironment() {
"logo" => "",
"url" => "",
"css" => "default",
"hideInstitution" => 0,
"defaultLang" => "en",
"cacheRefreshInterval" => 0,
"mdVersion" => "https://rlp.museum-digital.de/",
"mdImgFolder" => "https://rlp.museum-digital.de/data/rlp/",
"hideInstitution" => 0,
"limitToInstitutions" => [],
"sendHTTPHeaders" => 1,
"CSPimageSources" => "",
"CSPobjectSources" => "",
"maxFileSize" => 300000,
"defaultLang" => "en"
],
json_decode(file_get_contents(__DIR__ . "/../data/settings.json"), true)
);
$GLOBALS['settings'] = $settings;
if ($settings['sendHTTPHeaders']) {
header('X-Content-Type-Options: nosniff');
header('X-XSS-Protection: 1; mode=block');
header('Strict-Transport-Security: max-age=31536000; preload');
header('Referrer-Policy: strict-origin');
}
}