原来限制在这里,越越来越有意思..
/**
* 拿到后台的CSP Heaeder
*
* @return string
*/
function GetBackendCSPHeader()
{
$defaultCSP = array(
'default-src' => "'self' data: blob:",
'img-src' => "* data: blob:",
'media-src' => "* data: blob:",
'script-src' => "'self' https://cdn.n.com 'unsafe-inline' 'unsafe-eval'",
'style-src' => "'self' https://cdn.n.com 'unsafe-inline'",
);
foreach ($GLOBALS['hooks']['Filter_Plugin_CSP_Backend'] as $fpname => &$fpsignal) {
$fpreturn = $fpname($defaultCSP);
}
$ret = array();
foreach ($defaultCSP as $key => $value) {
$ret[] = $key . ' ' . $value;
}
return implode('; ', $ret);
}
