Allow inline style and srcipt eval in NC 15 #552
Conversation
controller/pagecontroller.php
Outdated
|
|
||
| $csp = new StrictContentSecurityPolicy(); | ||
| $csp->allowEvalScript(); | ||
| $csp->allowInlineStyle(); |
There was a problem hiding this comment.
Please, fix this indentation
|
Hmmm... i have been checking and the error seems to be on the angular code, nothing on passman side, so i don't think we should allow this behaviour unless we really need it for some parts of the code as it would lower the security of the app. Do you have any examples of something in the app that requires this kind of includes to work correctly? If so, do you see any clear way to fix so? For what I've seen on the minified angular code it looks like angularjs is checking if that feature is available on the browser for some reason unknown to me. Sorry for the late in depth review, didn't have time to prepare a release until today :c |
|
The javascript debugger feature seems to be causing issues (https://github.com/nextcloud/passman/blob/master/js/app/controllers/main.js#L63). |
If you open the debugging tools while using Passman you see a lot of Content-Security-Policy errors because Nextcloud 15 does no longer allow eval and inline css by default. This patch adds a custom CSP which allows this and resolves the issues.