diff --git a/src/Ui/UiRequest.py b/src/Ui/UiRequest.py index fa03bdca..b55fa78d 100644 --- a/src/Ui/UiRequest.py +++ b/src/Ui/UiRequest.py @@ -318,16 +318,6 @@ class UiRequest: else: return referer - def isScriptNonceSupported(self): - user_agent = self.env.get("HTTP_USER_AGENT") - if "Edge/" in user_agent: - is_script_nonce_supported = False - elif "Safari/" in user_agent and "Chrome/" not in user_agent: - is_script_nonce_supported = False - else: - is_script_nonce_supported = True - return is_script_nonce_supported - def getRequestSite(self): """Return 0net site addr associated with current request @@ -356,8 +346,8 @@ class UiRequest: if noscript: headers["Content-Security-Policy"] = "default-src 'none'; sandbox allow-top-navigation allow-forms; img-src *; font-src * data:; media-src *; style-src * 'unsafe-inline';" - elif script_nonce and self.isScriptNonceSupported(): - headers["Content-Security-Policy"] = f"default-src 'none'; script-src 'nonce-{script_nonce}'; img-src 'self' blob: data:; style-src 'self' blob: 'unsafe-inline'; connect-src *; frame-src 'self' blob:" + elif script_nonce: + headers["Content-Security-Policy"] = "default-src 'none'; script-src 'nonce-{0}'; img-src 'self' blob: data:; style-src 'self' blob: 'unsafe-inline'; connect-src *; frame-src 'self' blob:".format(script_nonce) if allow_ajax: headers["Access-Control-Allow-Origin"] = "null"