PHP TemplateResponse::setContentSecurityPolicy方法代码示例

 /**
  * @NoAdminRequired
  * @NoCSRFRequired
  */
 public function index()
 {
     \OCP\Util::addscript('core', 'tags');
     \OCP\Util::addStyle($this->appName, 'style');
     \OCP\Util::addStyle($this->appName, 'jquery.Jcrop');
     \OCP\Util::addStyle($this->appName, '3rdparty/fontello/css/animation');
     \OCP\Util::addStyle($this->appName, '3rdparty/fontello/css/fontello');
     \OCP\Util::addStyle($this->appName, '3rdparty/jquery.webui-popover');
     \OCP\Util::addscript($this->appName, 'app');
     \OCP\Util::addscript($this->appName, '3rdparty/jquery.webui-popover');
     \OCP\Util::addscript($this->appName, 'settings');
     \OCP\Util::addscript($this->appName, 'loader');
     \OCP\Util::addscript($this->appName, 'jquery.scrollTo.min');
     \OCP\Util::addscript($this->appName, 'jquery.nicescroll.min');
     \OCP\Util::addscript('files', 'jquery.fileupload');
     \OCP\Util::addscript($this->appName, 'jquery.Jcrop');
     $iosSupport = $this->configInfo->getUserValue($this->userId, $this->appName, 'iossupport');
     $maxUploadFilesize = \OCP\Util::maxUploadFilesize('/');
     $addressbooks = Addressbook::all($this->userId);
     if (count($addressbooks) == 0) {
         Addressbook::addDefault($this->userId);
         $addressbooks = Addressbook::all($this->userId);
     }
     //ContactsApp::addingDummyContacts(50);
     $params = ['uploadMaxFilesize' => $maxUploadFilesize, 'uploadMaxHumanFilesize' => \OCP\Util::humanFileSize($maxUploadFilesize), 'iossupport' => $iosSupport, 'addressbooks' => $addressbooks];
     $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
     $csp->addAllowedImageDomain('*');
     $csp->addAllowedFrameDomain('*');
     $response = new TemplateResponse($this->appName, 'index');
     $response->setContentSecurityPolicy($csp);
     $response->setParams($params);
     return $response;
 }

 /**
  * @NoAdminRequired
  * @NoCSRFRequired
  */
 public function index()
 {
     $status = $this->statusService->getStatus();
     $response = new TemplateResponse($this->appName, 'index', ['cronWarning' => $status['warnings']['improperlyConfiguredCron']]);
     $csp = new ContentSecurityPolicy();
     $csp->addAllowedImageDomain('*')->addAllowedMediaDomain('*')->addAllowedConnectDomain('*')->addAllowedFrameDomain('https://youtube.com')->addAllowedFrameDomain('https://www.youtube.com')->addAllowedFrameDomain('https://player.vimeo.com')->addAllowedFrameDomain('https://www.player.vimeo.com');
     $response->setContentSecurityPolicy($csp);
     return $response;
 }

 /**
  * CAUTION: the @Stuff turn off security checks, for this page no admin is
  *          required and no CSRF check. If you don't know what CSRF is, read
  *          it up in the docs or you might create a security hole. This is
  *          basically the only required method to add this exemption, don't
  *          add it to any other method if you don't exactly know what it does
  *
  * @NoAdminRequired
  * @NoCSRFRequired
  */
 public function index()
 {
     $params = array('user' => $this->userId);
     $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
     $csp->addAllowedImageDomain('data:');
     $response = new TemplateResponse('ownnote', 'main', $params);
     $response->setContentSecurityPolicy($csp);
     return $response;
 }

 public function testShowPdfViewer()
 {
     $params = ['urlGenerator' => $this->urlGenerator];
     $expectedResponse = new TemplateResponse($this->appName, 'viewer', $params, 'blank');
     $policy = new ContentSecurityPolicy();
     $policy->addAllowedChildSrcDomain('\'self\'');
     $policy->addAllowedFontDomain('data:');
     $expectedResponse->setContentSecurityPolicy($policy);
     $this->assertEquals($expectedResponse, $this->controller->showPdfViewer());
 }

 /**
  * @PublicPage
  * @NoCSRFRequired
  *
  * @return TemplateResponse
  */
 public function showPdfViewer()
 {
     $params = ['urlGenerator' => $this->urlGenerator];
     $response = new TemplateResponse($this->appName, 'viewer', $params, 'blank');
     $policy = new ContentSecurityPolicy();
     $policy->addAllowedChildSrcDomain('\'self\'');
     $policy->addAllowedFontDomain('data:');
     $response->setContentSecurityPolicy($policy);
     return $response;
 }

 /**
  * @NoAdminRequired
  * @NoCSRFRequired
  */
 public function index()
 {
     $bookmarkleturl = $this->urlgenerator->getAbsoluteURL('index.php/apps/bookmarks/bookmarklet');
     $params = array('user' => $this->userId, 'bookmarkleturl' => $bookmarkleturl);
     $policy = new ContentSecurityPolicy();
     $policy->addAllowedFrameDomain("'self'");
     $response = new TemplateResponse('bookmarks', 'main', $params);
     $response->setContentSecurityPolicy($policy);
     return $response;
 }

 /**
  * @NoAdminRequired
  * @NoCSRFRequired
  */
 public function webRTC()
 {
     $params = [];
     $response = new TemplateResponse(Settings::APP_ID, 'webrtc', $params);
     // Allow to embed iframes
     $csp = new ContentSecurityPolicy();
     //$csp->addAllowedFrameDomain('*');
     $csp->addAllowedFrameDomain(implode(' ', Security::getAllowedIframeDomains()));
     $response->setContentSecurityPolicy($csp);
     return $response;
 }

 /**
  * @NoCSRFRequired
  * @return TemplateResponse
  */
 public function viewApps()
 {
     $params = [];
     $params['experimentalEnabled'] = $this->config->getSystemValue('appstore.experimental.enabled', false);
     $this->navigationManager->setActiveEntry('core_apps');
     $templateResponse = new TemplateResponse($this->appName, 'apps', $params, 'user');
     $policy = new ContentSecurityPolicy();
     $policy->addAllowedImageDomain('https://apps.owncloud.com');
     $templateResponse->setContentSecurityPolicy($policy);
     return $templateResponse;
 }

 /**
  * @NoAdminRequired
  * @NoCSRFRequired
  * @PublicPage
  */
 public function webRTC()
 {
     $params = ['is_guest' => $this->userid === null];
     $response = new TemplateResponse(Settings::APP_ID, 'webrtc', $params, $this->userid === null ? 'empty' : 'user');
     // Allow to embed iframes
     $csp = new ContentSecurityPolicy();
     //$csp->addAllowedFrameDomain('*');
     $csp->addAllowedFrameDomain(implode(' ', Security::getAllowedIframeDomains()));
     $response->setContentSecurityPolicy($csp);
     return $response;
 }

 /**
  * @NoAdminRequired
  */
 public function cropPhoto()
 {
     $id = $this->params('id');
     $tmpkey = $this->params('tmpkey');
     $params = array('tmpkey' => $tmpkey, 'id' => $id);
     $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
     $csp->addAllowedImageDomain('data:');
     $response = new TemplateResponse($this->appName, 'part.cropphoto', $params, '');
     $response->setContentSecurityPolicy($csp);
     return $response;
 }

 /**
  * @NoAdminRequired
  * @NoCSRFRequired
  *
  * @return TemplateResponse renders the index page
  */
 public function index()
 {
     $response = new TemplateResponse($this->appName, 'index', []);
     // set csp rules for ownCloud 8.1
     if (class_exists('OCP\\AppFramework\\Http\\ContentSecurityPolicy')) {
         $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
         $csp->addAllowedFrameDomain('\'self\'');
         $response->setContentSecurityPolicy($csp);
     }
     return $response;
 }

 public function testIndex()
 {
     $expected = new TemplateResponse($this->appName, 'index', []);
     // set csp rules for ownCloud 8.1
     if (class_exists('OCP\\AppFramework\\Http\\ContentSecurityPolicy')) {
         $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
         $csp->addAllowedFrameDomain('\'self\'');
         $expected->setContentSecurityPolicy($csp);
     }
     $response = $this->controller->index();
     $this->assertEquals($expected, $response);
 }

 /**
  * CAUTION: the @Stuff turn off security checks, for this page no admin is
  *          required and no CSRF check. If you don't know what CSRF is, read
  *          it up in the docs or you might create a security hole. This is
  *          basically the only required method to add this exemption, don't
  *          add it to any other method if you don't exactly know what it does
  *
  * @NoAdminRequired
  * @NoCSRFRequired
  */
 public function index()
 {
     $params = array('user' => $this->userId);
     $response = new TemplateResponse('ownmnote', 'main', $params);
     $ocVersion = \OCP\Util::getVersion();
     if ($ocVersion[0] > 8 || $ocVersion[0] == 8 && $ocVersion[1] >= 1) {
         $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
         $csp->addAllowedImageDomain('data:');
         $response->setContentSecurityPolicy($csp);
     }
     return $response;
 }

 /**
  * @PublicPage
  * @NoCSRFRequired
  *
  * @return TemplateResponse
  */
 public function showReader()
 {
     $params = ['urlGenerator' => $this->urlGenerator];
     $response = new TemplateResponse($this->appName, 'reader', $params, 'blank');
     $csp = new ContentSecurityPolicy();
     $csp->addAllowedChildSrcDomain('\'self\'');
     $csp->addAllowedFrameDomain('\'self\'');
     $csp->addAllowedStyleDomain('blob:');
     $csp->addAllowedImageDomain('blob:');
     $response->setContentSecurityPolicy($csp);
     return $response;
 }

 /**
  * @NoAdminRequired
  * @NoCSRFRequired
  */
 public function index()
 {
     if (\OC::$server->getAppManager()->isEnabledForUser('calendarplus')) {
         $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
         $csp->addAllowedImageDomain(':data');
         $config = \OC::$server->getConfig();
         $response = new TemplateResponse($this->appName, 'index');
         $response->setParams(array('allowShareWithLink' => $config->getAppValue('core', 'shareapi_allow_links', 'yes'), 'mailNotificationEnabled' => $config->getAppValue('core', 'shareapi_allow_mail_notification', 'no'), 'mailPublicNotificationEnabled' => $config->getAppValue('core', 'shareapi_allow_public_notification', 'no'), 'appname' => TasksApp::$appname, 'calappname' => CalendarApp::$appname));
         $response->setContentSecurityPolicy($csp);
     } else {
         \OCP\Util::addStyle($this->appName, 'style');
         $response = new TemplateResponse($this->appName, 'no-calendar-app');
     }
     return $response;
 }