custom X-Content-Security-Policy

[jeckyll]

Hello

i wrote a little plug-in that basically replace <latex>some fomula</latex> in multi-text field by an image generated with MathTex

The resulting img tag looks like <img src="http://<mathtex_server_url>/mathtex.cgi?some formula" />

it works pretty well on IE but not on Firefox because of the "X-Content-Security-Policy"

The solution I found is to modify http_security_headers() in http_api (replacing "allow 'self'" by "allow 'self' <mathtex_server_url>")

May it be possible to do this in a less "hacky" way ?

Regards

[jeckyll]

I'm moving from MathTex to MathJax but I think that my question is still relevant since I must allow remote js scripts (from MathJax Contents Delivery Network) to execute on my server

[systemmind]

Hello. Could you provide your plugin please? I would want to get such functionality and maybe we would check how this issue reproduced now.

[dregad]

Have a look at how it's done in the MantisGraph core plugin

• Declare event in hooks()

  Code: Select all

  'EVENT_CORE_HEADERS' => 'csp_headers',

• Add CSP header

  Code: Select all

  	function csp_headers() {
  		if( config_get_global( 'cdn_enabled' ) == ON ) {
  			http_csp_add( 'script-src', self::CHARTJS_CDN );
  		}
  	}