set CSP also as meta tag, to deal with misconfigured webservers mangling the HTTP header

2022-03-13 17:24:47 +01:00
parent 1807580226
commit 6c1f0dde0c
5 changed files with 15 additions and 0 deletions
--- a/tpl/bootstrap.php
+++ b/tpl/bootstrap.php
@@ -7,6 +7,7 @@ $isPage = substr($template, -5) === '-page';
 <html lang="<?php echo I18n::_('en'); ?>">
 	<head>
 		<meta charset="utf-8" />
+		<meta http-equiv="Content-Security-Policy" content="<?php echo I18n::encode($CSPHEADER); ?>">
 		<meta http-equiv="X-UA-Compatible" content="IE=edge">
 		<meta name="viewport" content="width=device-width, initial-scale=1">
 		<meta name="robots" content="noindex" />