Add custom CSP for Win 10 compatibility

[LukasReschke]

The default content-security-policy of ownCloud forbids inline
JavaScript for security reasons. Edge starting on Windows 10 will
however also obey the CSP which will break the event source fallback.
As a workaround thus we set a custom policy which allows the execution
of inline JavaScript.

This fixes #14286 and is also required for owncloud/gallery#206

[scrutinizer-notifier]

A new inspection was created.

[LukasReschke]

@karlitschek Should get backported to the older releases. Win 10 will add CSP support which makes ownCloud pretty much unusable on newer IEs then as the EventSource is used for some other stuff as well such as the update process and also file listing if I'm not completely wrong.

If you agree I will prepare backports for stable7 - stable8.1.

[ghost]

🚀 Test PASSed.🚀

[karlitschek]

@LukasReschke Nice. Please backport 👍

[LukasReschke]

So anybody up to review this since Win 10 has been released? 🙊

To test this access http://localhost/master/index.php/apps/files/ajax/scan.php?dir=/&force=true&requesttoken=urUGo9SQ01D4vPn8iWouZdByLYGLFK&fallback=true&=fallback_id=2 (obviously adjust the request token).

Before the CSP header was: Content-Security-Policy:default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src *; font-src 'self' data:; media-src *; connect-src *
With this patch the header is: Content-Security-Policy:default-src 'none'; script-src 'unsafe-inline'

The unsafe-inline allows inline JS for this resource.

[DeepDiver1975]

@rperezb qa please 🙊 THX a lot

[rperezb]

Checking with @bboule for the environment to check this

[LukasReschke]

Ping? 🙊

[LukasReschke]

Pong? 🙉

[SergioBertolinSG]

Using edge in windows 10. After accessing the provided url I am getting same headers as before.
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src *; font-src 'self' data:; media-src *; connect-src *

[LukasReschke]

Are you sure you read the Content-Security-Policy of the EventSource page? This seems to work fine for me:

[SergioBertolinSG]

I've tried with that /master/ folder in the url and without it, same result in this headers.

[LukasReschke]

Are you sure the patch is applied? 52328 which has as per the Web UI 52330 as SSH port hasn't.

[SergioBertolinSG]

Yes, sorry, I patched the wrong server.

Now it is working fine
Content-Security-Policy: default-src 'none'; script-src 'unsafe-inline'

[SergioBertolinSG]

Update is working correctly as well. (without the patch it didn't redirect, not sure if related) 👍

[LukasReschke]

stable8.1: #18957
stable8: #18958