Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Implement Strict-Transport-Security and Permissions-Policy for

Browse Source 
backoffice pages.
This commit is contained in:
ldestailleur
2025-08-21 20:52:07 +02:00
parent d4cc80f18d
commit a9c6069478
3 changed files with 36 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
htdocs/main.inc.php
View File

@@ -1557,10 +1557,34 @@ function top_httphead($contenttype = 'text/html', $forcenocache = 0)
// Note that we do not use 'strict-origin' as this breaks feature to restore filters when clicking on "back to page" link on some cases.
if (!defined('MAIN_SECURITY_FORCERP')) {
$referrerpolicy = getDolGlobalString('MAIN_SECURITY_FORCERP', "same-origin");
header("Referrer-Policy: ".$referrerpolicy);
if (!empty($referrerpolicy)) {
header("Referrer-Policy: ".$referrerpolicy);
}
} else {
header("Referrer-Policy: ".constant('MAIN_SECURITY_FORCERP'));
}
// Strict-Transport-Security
if (!defined('MAIN_SECURITY_FORCESTS')) {
$sts = getDolGlobalString('MAIN_SECURITY_FORCESTS', "");
if (!empty($sts)) {
header("Strict-Transport-Security: ".$sts);
}
} else {
header("Strict-Transport-Security: ".constant('MAIN_SECURITY_FORCESTS'));
}
// Permissions-Policy (old name was Feature-Policy)
if (!defined('MAIN_SECURITY_FORCEPP')) {
$pp = getDolGlobalString('MAIN_SECURITY_FORCEPP', "");
if (!empty($pp)) {
header("Permissions-Policy: ".$pp);
}
} else {
header("Permissions-Policy: ".constant('MAIN_SECURITY_FORCEPP'));
}
// Cache
if ($forcenocache) {
header("Cache-Control: no-cache, no-store, must-revalidate, max-age=0");
}