ok
Direktori : /proc/self/root/var/softaculous/typo8/ |
Current File : //proc/self/root/var/softaculous/typo8/fileadmin.htaccess |
# This file applies Content-Security-Policy (CSP) HTTP headers # to directories containing (user uploaded) resources like # /fileadmin/ or /uploads/ <IfModule mod_headers.c> # matching requested *.pdf files only (strict rules block Safari showing PDF documents) <FilesMatch "\.pdf$"> Header set Content-Security-Policy "default-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'self'; plugin-types application/pdf;" </FilesMatch> # matching requested *.svg files only (allows using inline styles when serving SVG files) <FilesMatch "\.svg"> Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'unsafe-inline'; object-src 'none';" </FilesMatch> # matching anything else, using negative lookbehind pattern <FilesMatch "(?<!\.(?:pdf|svg))$"> Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';" </FilesMatch> # ================================================================= # Variations to send CSP header only when it has not be set before. # Adjust all `Header set` instructions above # Header set Content-Security-Policy "<directives>" # with substitutes shown below # # ----------------------------------------------------------------- # a) for Apache 2.4 (having `setifempty`) # ----------------------------------------------------------------- # Header setifempty Content-Security-Policy "<directives>" # # ----------------------------------------------------------------- # b) for Apache 2.2 (using fallbacks) # ----------------------------------------------------------------- # Header append Content-Security-Policy "" # Header edit Content-Security-Policy "^$" "<directives>" # # ================================================================= </IfModule>