soeren/fotospiel-app
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

verpfuschter stand von codex

Browse Source
This commit is contained in:
Codex Agent
2025-10-04 16:38:42 +02:00
parent c87cfb2c10
commit bc6a75961a
23 changed files with 2588 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

160
app/Http/Middleware/StripeCSP.php Normal file
View File

@@ -0,0 +1,160 @@
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
class StripeCSP
{
/**
* Apply a CSP that allows Stripe and PayPal assets on the purchase wizard.
*/
public function handle(Request $request, Closure $next): Response
{
$response = $next($request);
$isLocal = app()->environment('local');
$scriptSrc = [
"'self'",
"'unsafe-inline'",
'https://js.stripe.com',
'https://js.stripe.network',
'https://m.stripe.network',
'https://*.stripe.com',
'https://*.stripe.network',
'https://www.paypal.com',
'https://*.paypal.com',
'https://www.paypalobjects.com',
'https://*.paypalobjects.com',
];
$styleSrc = [
"'self'",
"'unsafe-inline'",
'data:',
'https:',
'https://*.stripe.com',
'https://*.stripe.network',
'https://www.paypal.com',
'https://*.paypal.com',
'https://www.paypalobjects.com',
'https://*.paypalobjects.com',
];
$imgSrc = [
"'self'",
'data:',
'https:',
'blob:',
'https://*.stripe.com',
'https://*.stripe.network',
'https://q.stripe.com',
'https://r.stripe.com',
'https://www.paypal.com',
'https://*.paypal.com',
'https://www.paypalobjects.com',
'https://*.paypalobjects.com',
];
$fontSrc = [
"'self'",
'data:',
'https:',
'https://*.stripe.com',
'https://*.stripe.network',
'https://www.paypalobjects.com',
'https://*.paypalobjects.com',
];
$connectSrc = [
"'self'",
'https://api.stripe.com',
'https://api.stripe.network',
'https://js.stripe.com',
'https://m.stripe.com',
'https://m.stripe.network',
'https://connect.stripe.com',
'https://*.stripe.com',
'https://*.stripe.network',
'https://r.stripe.com',
'https://q.stripe.com',
'https://www.paypal.com',
'https://*.paypal.com',
'https://www.paypalobjects.com',
'https://*.paypalobjects.com',
'wss://*.stripe.network',
];
$mediaSrc = [
"'self'",
'data:',
'blob:',
'https:',
'https://js.stripe.com',
'https://*.stripe.com',
'https://*.stripe.network',
'https://m.stripe.network',
'https://www.paypal.com',
'https://*.paypal.com',
'https://www.paypalobjects.com',
'https://*.paypalobjects.com',
];
$frameSrc = [
"'self'",
'https://js.stripe.com',
'https://*.stripe.com',
'https://hooks.stripe.com',
'https://www.paypal.com',
'https://*.paypal.com',
];
$workerSrc = [
"'self'",
'blob:',
'https://js.stripe.com',
'https://*.stripe.com',
'https://*.stripe.network',
'https://m.stripe.network',
'https://www.paypal.com',
'https://*.paypal.com',
];
if ($isLocal) {
$devHost = 'http://localhost:5173';
$scriptSrc[] = $devHost;
$styleSrc[] = $devHost;
$imgSrc[] = $devHost;
$fontSrc[] = $devHost;
$connectSrc[] = $devHost;
$connectSrc[] = 'ws://localhost:5173';
$mediaSrc[] = $devHost;
$frameSrc[] = $devHost;
$workerSrc[] = $devHost;
}
$directives = [
"default-src 'self'",
'script-src ' . implode(' ', $scriptSrc),
'style-src ' . implode(' ', $styleSrc),
'img-src ' . implode(' ', $imgSrc),
'font-src ' . implode(' ', $fontSrc),
'connect-src ' . implode(' ', $connectSrc),
'media-src ' . implode(' ', $mediaSrc),
'frame-src ' . implode(' ', $frameSrc),
'worker-src ' . implode(' ', $workerSrc),
'child-src ' . implode(' ', $frameSrc),
"object-src 'none'",
"base-uri 'self'",
"form-action 'self'",
];
$response->headers->set('Content-Security-Policy', implode('; ', $directives) . ';');
return $response;
}
}