diff options
Diffstat (limited to 'onionshare/web/web.py')
| -rw-r--r-- | onionshare/web/web.py | 24 |
1 files changed, 15 insertions, 9 deletions
diff --git a/onionshare/web/web.py b/onionshare/web/web.py index ecd9edc2..825e690c 100644 --- a/onionshare/web/web.py +++ b/onionshare/web/web.py @@ -91,15 +91,6 @@ class Web: # Monkey-patch in the fix from https://github.com/pallets/flask/commit/99c99c4c16b1327288fd76c44bc8635a1de452bc Flask.select_jinja_autoescape = self._safe_select_jinja_autoescape - self.security_headers = [ - ('Content-Security-Policy', 'default-src \'self\'; style-src \'self\'; script-src \'self\'; img-src \'self\' data:;'), - ('X-Frame-Options', 'DENY'), - ('X-Xss-Protection', '1; mode=block'), - ('X-Content-Type-Options', 'nosniff'), - ('Referrer-Policy', 'no-referrer'), - ('Server', 'OnionShare') - ] - self.q = queue.Queue() self.password = None @@ -293,6 +284,20 @@ class Web: pass self.running = False + def set_security_headers(self): + """ + Set the security headers for the web service each time we start it. + """ + self.security_headers = [ + ('X-Frame-Options', 'DENY'), + ('X-Xss-Protection', '1; mode=block'), + ('X-Content-Type-Options', 'nosniff'), + ('Referrer-Policy', 'no-referrer'), + ('Server', 'OnionShare') + ] + if self.common.settings.get('csp_header_enabled'): + self.security_headers.append(('Content-Security-Policy', 'default-src \'self\'; style-src \'self\'; script-src \'self\'; img-src \'self\' data:;')) + def start(self, port, stay_open=False, public_mode=False, password=None): """ Start the flask web server. @@ -315,6 +320,7 @@ class Web: host = '127.0.0.1' self.running = True + self.set_security_headers() self.app.run(host=host, port=port, threaded=True) def stop(self, port): |