From 30e00e09ad14ef87c2c8ad847f5b2aff414d11a6 Mon Sep 17 00:00:00 2001
From: Jannik Beyerstedt <code@jannikbeyerstedt.de>
Date: Sat, 15 Oct 2016 20:10:34 +0200
Subject: [PATCH] [SITE] new CSP without 'unsafe-inline'

---
 site/config/config.php          | 2 +-
 site/plugins/piwik/template.php | 2 +-
 site/snippets/base/html-end.php | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/site/config/config.php b/site/config/config.php
index 5c02a23..4b1fe15 100644
--- a/site/config/config.php
+++ b/site/config/config.php
@@ -1,5 +1,5 @@
 <?php
-header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; frame-src https://*.youtube-nocookie.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://jannikb.aquila.uberspace.de/piwik/; img-src 'self' https://jannikb.aquila.uberspace.de/piwik/");
+header("Content-Security-Policy: default-src 'self'; style-src 'self' 'nonce-nRfqpuKWNuYyUAFPTr6WVNZk9' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; frame-src https://www.youtube-nocookie.com; script-src 'self' 'nonce-nRfqpuKWNuYyUAFPTr6WVNZk9' https://jannikb.aquila.uberspace.de/piwik/; img-src 'self' https://jannikb.aquila.uberspace.de/piwik/");
 //header("X-Content-Type-Options: nosniff");  // enabled at server-side
 //header("X-Frame-Options: deny");            // enabled at server-side
 //header("X-Xss-Protection: 1; mode=block");  // enabled at server-side
diff --git a/site/plugins/piwik/template.php b/site/plugins/piwik/template.php
index b508459..e6deb85 100755
--- a/site/plugins/piwik/template.php
+++ b/site/plugins/piwik/template.php
@@ -1,5 +1,5 @@
 <!-- Piwik -->
-<script type="text/javascript">
+<script type="text/javascript" nonce="nRfqpuKWNuYyUAFPTr6WVNZk9">
     var _paq = _paq || [];
     _paq.push(['trackPageView']);
     _paq.push(['enableLinkTracking']);
diff --git a/site/snippets/base/html-end.php b/site/snippets/base/html-end.php
index 3a218cd..c1d2d10 100644
--- a/site/snippets/base/html-end.php
+++ b/site/snippets/base/html-end.php
@@ -40,7 +40,7 @@ echo js('assets/vendors/bootstrap/js/dist/carousel.js');
 ?>
 
 <?php if (c::get('plg_masonry.enable') && $plg_masonry==true) : $width = c::get('plg_masonry.width');?>
-  <style>
+  <style nonce="nRfqpuKWNuYyUAFPTr6WVNZk9">
     #masonry {margin: 0 auto;}
       .masonryitem { width: <?php echo $width ?>px; margin-bottom: 10px;}
       .masonryitem.w2 { width: 40%; }
@@ -48,7 +48,7 @@ echo js('assets/vendors/bootstrap/js/dist/carousel.js');
 
   <?php echo js('assets/vendors/masonry/dist/masonry.pkgd.min.js');?>
 
-  <script type="text/javascript">
+  <script type="text/javascript" nonce="nRfqpuKWNuYyUAFPTr6WVNZk9">
     $('#masonry').masonry({
       isFitWidth: true,
       columnWidth: <?php echo c::get('plg_masonry.width') ?>,
@@ -60,7 +60,7 @@ echo js('assets/vendors/bootstrap/js/dist/carousel.js');
   <?php echo js('assets/vendors/swipebox/src/js/jquery.swipebox.min.js');?>
   <?php echo css('assets/vendors/swipebox/src/css/swipebox.css') ?>
 
-  <script type="text/javascript">
+  <script type="text/javascript" nonce="nRfqpuKWNuYyUAFPTr6WVNZk9">
   $(document).ready(function () {
     $('.swipebox' ).swipebox();
   });