content_security_policy block access

[Rno]

I have a plugin who access Goolmap or openstreetmap, and now it's blocked by content security.

Can you help me to know how/where I can add a directive like that:
"content_security_policy": "script-src 'self' https://maps.googleapis.com https://maps.gstatic.com; object-src 'self'"

Since with all included yode of cacti I can't find where to do that.

thanks for your help

[netniV]

It's a header that is exported I believe using the header() functionality of php.

[Osiris]

I think you should log this on GitHub.com in the cacti issue list.

[Rno]

The solution was to add the following few line to the httpd configuration of the cacti virtual server:
<IfModule mod_headers.c>
Header set Content-Security-Policy "default-src * 'self' style-src 'unsafe-inline' img-src 'self' data:"
</IfModule>


That solve the issue, so not sure it's a cacti thing!

[TheWitness]

The current content security policy will not allow that. However, you can open a bug request on the Cacti web site to allow the Admin to add a list of allowed offsite domains that can access content. This was done for security reasons.

[TheWitness]

I logged this one: https://github.com/Cacti/cacti/issues/3336