Bugfix: don't set empty CSP script nonce-

the-djmaze · the-djmaze · commit 68309e5f7b55 · 2022-10-12T10:33:25.000+02:00
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Service.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Service.php
@@ -249,7 +249,9 @@ private static function setCSP(string $sScriptNonce = null) : void
 			$CSP->img[] = 'https:';
 			$CSP->img[] = 'http:';
 		}
-		$CSP->script[] = "'nonce-{$sScriptNonce}'";
+		if ($sScriptNonce) {
+			$CSP->script[] = "'nonce-{$sScriptNonce}'";
+		}
 
 		Api::Actions()->Plugins()->RunHook('main.content-security-policy', array($CSP));
 

Original file line number	Diff line number	Diff line change
`@@ -249,7 +249,9 @@ private static function setCSP(string $sScriptNonce = null) : void`
`249`	`249`	`$CSP->img[] = 'https:';`
`250`	`250`	`$CSP->img[] = 'http:';`
`251`	`251`	`}`
`252`		`- $CSP->script[] = "'nonce-{$sScriptNonce}'";`
	`252`	`+ if ($sScriptNonce) {`
	`253`	`+ $CSP->script[] = "'nonce-{$sScriptNonce}'";`
	`254`	`+ }`
`253`	`255`
`254`	`256`	`Api::Actions()->Plugins()->RunHook('main.content-security-policy', array($CSP));`
`255`	`257`