introducing CSP header to mitigate XSS attacks, closes #10

lib/Configuration.php

@@ -51,6 +51,7 @@ class Configuration
             'languagedefault' => '',
             'urlshortener' => '',
             'vizhash' => true,
+            'cspheader' => 'default-src \'none\'; connect-src *; script-src \'self\'; style-src \'self\'; font-src \'self\'; img-src \'self\';',
             'zerobincompatibility' => false,
         ),
         'expire' => array(

lib/PrivateBin.php

@@ -402,6 +402,7 @@ class PrivateBin
         header('Expires: ' . $time);
         header('Last-Modified: ' . $time);
         header('Vary: Accept');
+        header('Content-Security-Policy: ' . $this->_conf->getKey('cspheader'));
 
         // label all the expiration options
         $expire = array();