Piwik\View\

SecurityPolicy

Content Security Policy HTTP Header management class

Methods

The class defines the following methods:

• addPolicy() — Appends a policy to a directive.
• removeDirective() — Removes a directive.
• overridePolicy() — Overrides a directive.
• disable() — Disable CSP
• restrictToDataResponse() — Replaces all directives with a policy for responses that are data rather than application UI (API output, exports, generated reports): no scripts, plugins, framing, form submissions or base URI overrides.
• allowEmbedPage() — A less restrictive CSP which will allow embedding other sites with iframes (useful for heatmaps and session recordings)

addPolicy()

Appends a policy to a directive.

Signature

• It accepts the following parameter(s):

  • $directive

  • $value

• It does not return anything or a mixed result.

removeDirective()

Removes a directive.

Signature

• It accepts the following parameter(s):

  • $directive

• It does not return anything or a mixed result.

overridePolicy()

Overrides a directive.

Signature

• It accepts the following parameter(s):

  • $directive

  • $value

• It does not return anything or a mixed result.

disable()

Disable CSP

Signature

• It does not return anything or a mixed result.

restrictToDataResponse()

Replaces all directives with a policy for responses that are data rather than application UI (API output, exports, generated reports): no scripts, plugins, framing, form submissions or base URI overrides. Inline styles and first-party images stay allowed, as reports need both.

Call this on an instance of your own: the shared one a controller exposes as $this->securityPolicy builds the policy of the surrounding page. The policy is always enforced, whatever [General] csp_report_only is set to.

Signature

• It returns a void value.

allowEmbedPage()

A less restrictive CSP which will allow embedding other sites with iframes (useful for heatmaps and session recordings)

Signature

• It does not return anything or a mixed result.