PDFViewer / CSP - frame-src object-src blob:

[vkael]

Description

Using Owncloud Web 6.0.0, it is not possible to display a PDF using PDF Viewer cause the CSP is too restrictive.

It returns :

Content Security Policy: The page’s settings blocked the loading of a resource at blob:https://xyz.com/bb6b39b8-1d71-4960-bc4c-16ab79bc1044 (“default-src”).

Related Issue

• Fixes PDFViewer / Content Security Policy blocks 'blob:'
• Fixes [oC10] PDFs can't be opened (local Docker setup) #7931
• Fixes PDFViewer / Content Security Policy blocks 'blob:' and 'frame-src' #8497

Motivation and Context

PDF will be working on Firefox out of the box.

How Has This Been Tested?

• test environment:
  Old owncloud server running, updated to 10.11; added new configuration to support OwnCloud Web new front-end.

Screenshots (if appropriate):

Before :
CSP configuration :

View :

After, with updated CSP and visible PDF :

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Database schema changes (next release will require increase of minor version instead of patch)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:
• Changelog item, see TEMPLATE

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[CLAassistant]

All committers have signed the CLA.

[JammingBen]

Big thanks for the contribution, works like a charm! 🥳

[JammingBen]

Could you please give the changelog file a proper title though? Something like bugfix-oc10-pdf-display.

[vkael]

Done in 7b27c7c @JammingBen

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information