tilderadio/AzuraCast
4
0
Fork 0
mirror of https://github.com/AzuraCast/AzuraCast.git synced 2024-06-18 23:17:05 +00:00
Code Issues Releases Wiki Activity

Fix CSP injection in View class.

Browse Source
This commit is contained in:
Buster "Silver Eagle" Neece 2020-12-10 18:22:54 -06:00
parent 4aa1902dae
commit 81aea98efa
No known key found for this signature in database
GPG Key ID: 6D9E12FF03411F4E
1 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/View.php
View File

@ -2,7 +2,6 @@
namespace App;
use App\Http\Response;
use App\Http\ServerRequest;
use DI\FactoryInterface;
use Doctrine\Inflector\InflectorFactory;
@ -15,6 +14,8 @@ use Symfony\Component\VarDumper\Dumper\CliDumper;
class View extends Engine
{
protected Assets $assets;
public function __construct(
FactoryInterface $factory,
Environment $environment,
@ -33,7 +34,7 @@ class View extends Engine
);
// Add request-dependent content.
$assets = $factory->make(
$this->assets = $factory->make(
Assets::class,
[
'request' => $request,
@ -48,7 +49,7 @@ class View extends Engine
'acl' => $request->getAttribute(ServerRequest::ATTR_ACL),
'customization' => $request->getAttribute(ServerRequest::ATTR_CUSTOMIZATION),
'flash' => $request->getAttribute(ServerRequest::ATTR_SESSION_FLASH),
'assets' => $assets,
'assets' => $this->assets,
]
);
@ -159,12 +160,6 @@ class View extends Engine
$response->getBody()->write($template);
$response = $response->withHeader('Content-type', 'text/html; charset=utf-8');
if ($response instanceof Response && !$response->hasCacheLifetime()) {
/** @var Assets $assets */
$assets = $this->getData('assets');
$response = $assets->writeCsp($response);
}
return $response;
return $this->assets->writeCsp($response);
}
}