mirrors/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent.git synced 2024-10-22 10:46:04 +03:00
Code Issues Projects Releases Packages Wiki Activity

[WebUI]: add X-XSS-Protection, X-Content-Type-Options, CSP header

Browse source
This commit is contained in:
Chocobo1 2017-02-05 12:19:47 +08:00 committed by sledgehammer999
parent f9f7a8cbf2
commit edaa7e85a7
No known key found for this signature in database
GPG key ID: 6E4A2D025B7CC9A2
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/base/http/types.h
View file

@ -44,6 +44,9 @@ namespace Http
const QString HEADER_CONTENT_LENGTH = "Content-Length";
const QString HEADER_CACHE_CONTROL = "Cache-Control";
const QString HEADER_X_FRAME_OPTIONS = "X-Frame-Options";
const QString HEADER_X_XSS_PROTECTION = "X-XSS-Protection";
const QString HEADER_X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options";
const QString HEADER_CONTENT_SECURITY_POLICY = "Content-Security-Policy";
const QString CONTENT_TYPE_CSS = "text/css; charset=UTF-8";
const QString CONTENT_TYPE_GIF = "image/gif";

3
src/webui/abstractwebapplication.cpp
View file

@ -106,6 +106,9 @@ Http::Response AbstractWebApplication::processRequest(const Http::Request &reque
// avoid clickjacking attacks
header(Http::HEADER_X_FRAME_OPTIONS, "SAMEORIGIN");
header(Http::HEADER_X_XSS_PROTECTION, "1; mode=block");
header(Http::HEADER_X_CONTENT_TYPE_OPTIONS, "nosniff");
header(Http::HEADER_CONTENT_SECURITY_POLICY, "default-src 'self' 'unsafe-inline' 'unsafe-eval';");
sessionInitialize();
if (!sessionActive() && !isAuthNeeded())