All: switch to enforced CSP header

timmywil · web-flow · commit 31f2f0830f9a · 2024-12-16T12:33:31.000-05:00
Ref jquery/infrastructure-puppet#54 Closes gh-476
diff --git a/themes/jquery/functions.php b/themes/jquery/functions.php
@@ -289,7 +289,7 @@ function jq_content_security_policy() {
 	}
 
 	header( 'Reporting-Endpoints: csp-endpoint="' . $report_url . '"' );
-	header( 'Content-Security-Policy-Report-Only: ' . $policy_string );
+	header( 'Content-Security-Policy: ' . $policy_string );
 }
 
 add_action( 'send_headers', 'jq_content_security_policy' );

Original file line number	Diff line number	Diff line change
`@@ -289,7 +289,7 @@ function jq_content_security_policy() {`
`289`	`289`	`}`
`290`	`290`
`291`	`291`	`header( 'Reporting-Endpoints: csp-endpoint="' . $report_url . '"' );`
`292`		`- header( 'Content-Security-Policy-Report-Only: ' . $policy_string );`
	`292`	`+ header( 'Content-Security-Policy: ' . $policy_string );`
`293`	`293`	`}`
`294`	`294`
`295`	`295`	`add_action( 'send_headers', 'jq_content_security_policy' );`