Page MenuHomePhabricator

Add CSP policy to installer
Open, Needs TriagePublic

Description

Should be fairly easy to do, as its isolated from rest of MW

Only noteworthy thing is the CC license picker.

Doing this also helps with T238367.

Related Objects

StatusSubtypeAssignedTask
OpenNone
OpenNone

Event Timeline

The policy I'm thinking of: default-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; script-src 'self' 'nonce-VnNsWAXz4PjrGZ0kPP5hGvDa'; img-src 'self' data: i.creativecommons.org licensebuttons.net; frame-src creativecommons.org 'self'; base-uri 'none'

Change 584268 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/core@master] Add a CSP policy to the installer

https://gerrit.wikimedia.org/r/584268