Initial support for Content Security Policy, disabled by default

[lhc/web/wiklou.git] / includes / api / ApiCSPReport.php

diff --git a/includes/api/ApiCSPReport.php b/includes/api/ApiCSPReport.php
index af040d1..42d1093 100644 (file)
--- a/includes/api/ApiCSPReport.php
+++ b/includes/api/ApiCSPReport.php
@@ -97,12 +97,22 @@ class ApiCSPReport extends ApiBase {
                }
 
                if (
-                       ( isset( $report['blocked-uri'] ) &&
-                       isset( $falsePositives[$report['blocked-uri']] ) )
-                       || ( isset( $report['source-file'] ) &&
-                       isset( $falsePositives[$report['source-file']] ) )
+                       (
+                               ContentSecurityPolicy::falsePositiveBrowser( $userAgent ) &&
+                               $report['blocked-uri'] === "self"
+                       ) ||
+                       (
+                               isset( $report['blocked-uri'] ) &&
+                               isset( $falsePositives[$report['blocked-uri']] )
+                       ) ||
+                       (
+                               isset( $report['source-file'] ) &&
+                               isset( $falsePositives[$report['source-file']] )
+                       )
                ) {
-                       // Report caused by Ad-Ware
+                       // False positive due to:
+                       // https://bugzilla.mozilla.org/show_bug.cgi?id=1026520
+
                        $flags[] = 'false-positive';
                }
                return $flags;