Send Content-Security-Policy headers in setup/ app (#17751)

fredden · web-flow · commit 6e14811a0512 · 2022-10-03T19:27:53.000-03:00
This pull request adds Content-Security-Policy and other security-related headers to the setup/ application, as requested in #12359. Fixes #12359 Signed-off-by: Dan Wallis <mrdanwallis@gmail.com>
diff --git a/setup/index.php b/setup/index.php
@@ -10,6 +10,7 @@
 use PhpMyAdmin\Controllers\Setup\HomeController;
 use PhpMyAdmin\Controllers\Setup\ServersController;
 use PhpMyAdmin\Core;
+use PhpMyAdmin\Header;
 use PhpMyAdmin\Template;
 use PhpMyAdmin\Url;
 
@@ -36,6 +37,9 @@
 
 Core::noCacheHeader();
 
+// Sent security-related headers
+(new Header())->sendHttpHeaders();
+
 if ($page === 'form') {
     echo (new FormController($GLOBALS['ConfigFile'], new Template()))([
         'formset' => $_GET['formset'] ?? null,
