Merge remote-tracking branch 'upstream/master' into curl-smtp

1 files changed, 5 insertions, 0 deletions

diff --git a/httpd.c b/httpd.c
index 5a38aff..22a148d 100644
--- a/httpd.c
+++ b/httpd.c
@@ -211,6 +211,8 @@ int server_get_handler(xs_dict *req, const char *q_path,
 {
     int status = 0;
 
+    const snac *user = NULL;
+
     /* is it the server root? */
     if (*q_path == '\0' || strcmp(q_path, "/") == 0) {
         const xs_dict *q_vars = xs_dict_get(req, "q_vars");
@@ -553,6 +555,9 @@ void httpd_connection(FILE *f)
     headers = xs_dict_append(headers, "access-control-allow-origin", "*");
     headers = xs_dict_append(headers, "access-control-allow-headers", "*");
 
+    /* disable any form of fucking JavaScript */
+    headers = xs_dict_append(headers, "Content-Security-Policy", "script-src ;");
+
     if (p_state->use_fcgi)
         xs_fcgi_response(f, status, headers, body, b_size, fcgi_id);
     else