diff --git a/login.php b/changeaccess.php similarity index 97% rename from login.php rename to changeaccess.php index 47de91d..2ade07a 100644 --- a/login.php +++ b/changeaccess.php @@ -130,7 +130,7 @@ endif;
- +
@@ -163,7 +163,7 @@ endif; getLoginURL()); ?>"> - + diff --git a/inc/footer.inc.php b/inc/footer.inc.php index 2d7d489..eb2b094 100755 --- a/inc/footer.inc.php +++ b/inc/footer.inc.php @@ -31,14 +31,14 @@ - - + - + diff --git a/inc/header.inc.php b/inc/header.inc.php index 9e08ca7..4f789be 100644 --- a/inc/header.inc.php +++ b/inc/header.inc.php @@ -80,9 +80,13 @@ $timeplus = new DateTime($StaticFunctions->getUTC(), new DateTimeZone('UTC')); // DUMB WAY TO CALCULATE SOME TIMES $timeplus->setTimezone(new DateTimeZone("$timezone")); $timenow = $timeplus->format('Y-m-d H:i:s'); + $_SESSION['nonce']= base64_encode(random_bytes(32)); + $noncestring="nonce-".$_SESSION['nonce']; + $urlsrc=basename($_SERVER['PHP_SELF']); header("X-Frame-Options: SAMEORIGIN"); header("X-Content-Type-Options: nosniff"); - //header("Content-Security-Policy: default-src '*'; script-src '*'"); + //header("Content-Security-Policy: default-src '$urlsrc'; script-src '$urlsrc'"); + header("Content-Security-Policy: default-src '$noncestring' 'self'; script-src '$noncestring' 'self' ; script-src-elem '$noncestring' 'self'; script-src-attr '$noncestring' 'self'; style-src '$noncestring' 'self'; style-src-elem '$noncestring' 'self'; style-src-attr '$noncestring' 'self'; img-src '$noncestring' 'self' data:; connect-src '$noncestring' 'self'; frame-src '$noncestring' 'self'; font-src '$noncestring' 'self'; media-src '$noncestring' 'self'; object-src '$noncestring' 'self'; manifest-src '$noncestring' 'self'; worker-src '$noncestring' 'self'; prefetch-src '$noncestring' 'self'; form-action '$noncestring' 'self'; frame-ancestors '$noncestring' 'self'"); //header("Content-Security-Policy: script-src 'self' 'unsafe-inline'; script-src-elem 'self'; script-src-attr 'self'; style-src 'self'; style-src-elem 'self'; style-src-attr 'self'; img-src 'self'; connect-src 'self'; frame-src 'self'; font-src 'self'; media-src 'self'; object-src 'self'; manifest-src 'self'; worker-src 'self'; prefetch-src 'self'; form-action 'self'; frame-ancestors 'self'; default-src 'self'", false); if (!empty($_GET['a'])) { echo '
' . print_r($_POST, true) . '
'; @@ -98,33 +102,33 @@ - + - - - - - - - - - - + + + + + + + + + + - - - - - - - - - - - - - + + + + + + + + + + + + + <?php echo $StaticFunctions->getTitle($app_current_pagename, $app_disp_lang); ?> @@ -133,7 +137,7 @@