Get rid of inline CSS and remove unsafe-inline gradually from controllers #1127

Activity

1. LukasReschke

   added

   enhancement

   help wanted

   good first issueSmall tasks with clear documentation about how and in which place you need to fix things in.Small tasks with clear documentation about how and in which place you need to fix things in.

   security

   on Aug 29, 2016
2. rullzer commented on Sep 4, 2016

   

   rullzer

   on Sep 4, 2016

   Member

   More actions

   So probabaly a good step would be to create a stricter CSP which Apps can then start to use already.

   Then we could also start logging warnings on the old CSP.
3. MorrisJobke

   added

   Hacktoberfest

   on Nov 7, 2017
4. MorrisJobke

   added

   good first issue

   and removed

   good first issue

   on Dec 29, 2017
5. MorrisJobke

   removed

   Hacktoberfest

   on Jan 12, 2018
6. jancborchardt

   removed

   good first issue

   on Jan 23, 2018
7. nextcloud-bot

   added

   staleTicket or PR with no recent activityTicket or PR with no recent activity

   on Jun 20, 2018
8. rullzer

   added

   Hacktoberfest

   on Oct 1, 2018
9. nextcloud-bot

   removed

   staleTicket or PR with no recent activityTicket or PR with no recent activity

   on Oct 1, 2018
10. skjnldsv

    removed

    Hacktoberfest

    on Dec 18, 2018
11. skjnldsv

    added

    1. to developAccepted and waiting to be taken care ofAccepted and waiting to be taken care of

    on Jun 12, 2019
12. sunny75016 commented on Apr 28, 2020

    

    sunny75016

    on Apr 28, 2020

    More actions

    Open almost 4 years. Grateful if the NC cloud can works towards a solution.
13. LukasReschke commented on Apr 28, 2020

    

    LukasReschke

    on Apr 28, 2020

    MemberAuthor

    More actions

    @sunny75016 I am sure Pull Requests are appreciated :-)

    👍React with 👍4Reacted by Doğan Can Uçar, Morris Jobke, Roeland Jago Douma and Carl Schwan
14. sunny75016 commented on Apr 29, 2020

    

    sunny75016

    on Apr 29, 2020

    More actions

    In this thread someone suggested creating a strict CSP. There is my humble suggestion to keep the CSP short. If we replace default-src with 'none', then it becomes too long.

    Apache2:
    Header set Content-Security-Policy "default-src 'self'; img-src data: 'self'; upgrade-insecure-requests;"

    I am not using nginx so someone else can write its equivalent. I hope the suggestion is useful to authors who want to get rid of 'unsafe-inline' from script-src.
15. joshtrichards

    removed

    good first issueSmall tasks with clear documentation about how and in which place you need to fix things in.Small tasks with clear documentation about how and in which place you need to fix things in.

    on Jul 31, 2024