Feeling Lucky
?
?
?
[#24674] - [4.0] System - HTTP Headers - Write headers to the configuration file
- Fixed in Code Base
- 25 Jul 2019
- Medium
- Build: 4.0-dev
- # 24674
- Diff
- zero-24:40_write_static_headers
- Pending Hound Hound is busy sniffing around... Details
User tests: Successful: Unsuccessful:
Summary of Changes
- Adds the new option
Write headers to the configuration file(source zero-24/plg_system_httpheader#6) - restructure the plugin
- cleaup xml, doc blocks and php code
Testing Instructions
Test Write headers to the configuration file
- Install Joomla 4.0
- apply this patch
- go to the plugin config
- enable the new option
Write headers to the configuration file - save the plugin
- check the content of the .htaccess | web.config file
- change the static header configurations
- save the plugin
- check the .htaccess | web.config file
Test the CSP Component Integration
- go to com_csp
- enable the detect option
- visit the backend and frontend
- notice the collected reports
- publish some of the reports
- enable the auto mode from the options (keep it report only for now :D)
- check the now generated csp header
- enable the custom mode
- configure a custom rule (adding script-src 'nonce-{nonce}' as minimum)
- check that
{nonce}has been replaced by the actual nonce
Expected result
The static headers are written to the respective server config file
Actual result
This option does not exists
Documentation Changes Required
- Update Screenshots (Plugin and Component options)
- Add new option description
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_csp Language & Strings Front End Plugins |
| Labels |
Added:
?
?
?
|
||
zero-24
- comment
- 16 Jun 2019
And I have been asked by @SniperSister to work on an approach for hash based whitlisting too, wich would massive conflict with this PR here too.
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-07-25 06:39:48 |
| Closed_By | ⇒ | wilsonge |
wilsonge
- comment
- 25 Jul 2019
Thanks!
zero-24
- comment
- 27 Jul 2019
Great, thanks
brianteeman
- comment
- 27 Jul 2019
This should not have been merged #25713 (comment)
@wilsonge I would like to add yet another feature that sets the
frame-ancestorsdirective when enabled can you give me a status how do you want to handle this PR?