diff --git a/libraries/src/Document/Renderer/Html/ScriptsRenderer.php b/libraries/src/Document/Renderer/Html/ScriptsRenderer.php index fbddfa2de54c7..e8fe01416a3a7 100644 --- a/libraries/src/Document/Renderer/Html/ScriptsRenderer.php +++ b/libraries/src/Document/Renderer/Html/ScriptsRenderer.php @@ -256,7 +256,7 @@ private function renderInlineElement($item) : string $buffer .= $tab . 'renderAttributes($attribs); - $buffer .= '>' . $lnEnd; + $buffer .= '>'; // This is for full XHTML support. if ($this->_doc->_mime !== 'text/html') @@ -264,7 +264,7 @@ private function renderInlineElement($item) : string $buffer .= $tab . $tab . '//_doc->_mime !== 'text/html') @@ -272,7 +272,7 @@ private function renderInlineElement($item) : string $buffer .= $tab . $tab . '//]]>' . $lnEnd; } - $buffer .= $tab . '' . $lnEnd; + $buffer .= '' . $lnEnd; return $buffer; } diff --git a/libraries/src/Document/Renderer/Html/StylesRenderer.php b/libraries/src/Document/Renderer/Html/StylesRenderer.php index fae8688186a0a..c130dcc8b5e75 100644 --- a/libraries/src/Document/Renderer/Html/StylesRenderer.php +++ b/libraries/src/Document/Renderer/Html/StylesRenderer.php @@ -250,7 +250,7 @@ private function renderInlineElement($item) : string $buffer .= $tab . 'renderAttributes($attribs); - $buffer .= '>' . $lnEnd; + $buffer .= '>'; // This is for full XHTML support. if ($this->_doc->_mime !== 'text/html') @@ -258,7 +258,7 @@ private function renderInlineElement($item) : string $buffer .= $tab . $tab . '/*_doc->_mime !== 'text/html') @@ -266,7 +266,7 @@ private function renderInlineElement($item) : string $buffer .= $tab . $tab . '/*]]>*/' . $lnEnd; } - $buffer .= $tab . '' . $lnEnd; + $buffer .= '' . $lnEnd; return $buffer; } diff --git a/plugins/system/httpheaders/httpheaders.php b/plugins/system/httpheaders/httpheaders.php index 9231a55865fe5..11795b19ea4a4 100644 --- a/plugins/system/httpheaders/httpheaders.php +++ b/plugins/system/httpheaders/httpheaders.php @@ -174,9 +174,12 @@ public function applyHashesToCspRule(): void // Generate the hashes for the style-src $inlineStyles = is_array($headData['style']) ? $headData['style'] : []; - foreach ($inlineStyles as $type => $styleContent) + foreach ($inlineStyles as $type => $styles) { - $styleHashes[] = "'sha256-" . base64_encode(hash('sha256', $styleContent, true)) . "'"; + foreach ($styles as $hash => $styleContent) + { + $styleHashes[] = "'sha256-" . base64_encode(hash('sha256', $styleContent, true)) . "'"; + } } } @@ -413,12 +416,12 @@ private function compileAutomaticCspHeaderRules(): array $cspHeaderCollection = array_merge($cspHeaderCollection, array_fill_keys(['default-src'], '')); } - if (!isset($cspHeaderCollection['script-src']) && $nonceEnabled) + if (!isset($cspHeaderCollection['script-src']) && ($scriptHashesEnabled || $nonceEnabled)) { $cspHeaderCollection = array_merge($cspHeaderCollection, array_fill_keys(['script-src'], '')); } - if (!isset($cspHeaderCollection['style-src']) && $nonceEnabled) + if (!isset($cspHeaderCollection['style-src']) && ($scriptHashesEnabled || $nonceEnabled)) { $cspHeaderCollection = array_merge($cspHeaderCollection, array_fill_keys(['style-src'], '')); }