search

phpsysinfo / phpsysinfo

phpSysInfo: a customizable PHP script that displays information about your system nicely
http://phpsysinfo.github.io/phpsysinfo
GNU General Public License v2.0
1.38k stars 233 forks source link

"eval" js #373

Closed dermatzeimnetz closed 1 year ago

dermatzeimnetz commented 1 year ago

By using the following Apache Header

Header set Content-Security-Policy: "default-src 'unsafe-inline' 'self' https:"

the javascript "eval" code is not executed anymore. You have to add it like this

Header set Content-Security-Policy: "default-src 'unsafe-inline' 'unsafe-eval' 'self' https:"

If possible please remove execution of eval javascript code

namiltd commented 1 year ago

Done: https://github.com/phpsysinfo/phpsysinfo/commit/e65ec8350227b40e086b54acbda820e25bf11bcc