From 90997e4eb5b1ed40cb14a413a990531ad410f045 Mon Sep 17 00:00:00 2001 From: Joshua Ramon Enslin Date: Sun, 22 Nov 2020 17:45:07 +0100 Subject: [PATCH] Add function for sending complete CSP headers --- MD_STD_SEC.php | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/MD_STD_SEC.php b/MD_STD_SEC.php index 383908f..db2ae77 100644 --- a/MD_STD_SEC.php +++ b/MD_STD_SEC.php @@ -122,4 +122,17 @@ final class MD_STD_SEC { return true; } + + /** + * Send CSP headers. + * + * @param array{default-src: string, connect-src: string, script-src: string, img-src: string, media-src: string, style-src: string, frame-src: string, object-src: string, base-uri: string, form-action: string} $directives Directives to send. Font source is always set to 'self', and hence excluded. + * + * @return void + */ + public static function sendContentSecurityPolicy(array $directives):void { + + header('Content-Security-Policy: default-src ' . $directives['default-src'] . '; connect-src ' . $directives['connect-src'] . '; script-src ' . $directives['script-src'] . '; img-src ' . $directives['img-src'] . '; media-src ' . $directives['media-src'] . '; style-src ' . $directives['style-src'] . '; font-src \'self\'; frame-src ' . $directives['frame-src'] . '; object-src ' . $directives['object-src'] . '; base-uri ' . $directives['base-uri'] . '; form-action ' . $directives['form-action'] . '; manifest-src \'self\''); + + } }