www/nginx: bugfix csp (#1243)

* www/nginx: fix content security settings

* www/nginx: fix content security settings

* www/nginx: fix content security settings

* Update www/nginx/pkg-descr

Co-Authored-By: fabianfrz <fabianfrz@users.noreply.github.com>

www/nginx/pkg-descr

@@ -8,6 +8,10 @@ reuse, SSL offload and HTTP media streaming.
 Plugin Changelog
 ================
 
+1.10
+
+* fix content security settings (missing checkbox, correct templating)
+
 1.9
 
 * add advanced options to configure hostname hash sizes for long hostnames

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml

@@ -82,6 +82,12 @@
     <type>checkbox</type>
     <help>If checked, the CSP is enabled.</help>
   </field>
+  <field>
+    <id>security_header.csp_report_only</id>
+    <label>Content Security Policy: Report Only</label>
+    <type>checkbox</type>
+    <help>If checked, the CSP is not enforced (learning mode).</help>
+  </field>
   <field>
     <type>header</type>
     <label>Content Security Policy: Default Source</label>

www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf

@@ -67,7 +67,7 @@
 {%   endfor %}
 {% do our_headers.append('Content-Security-Policy') %}
 {% do our_headers.append('Content-Security-Policy-Report-Only') %}
-    add_header Content-Security-Policy{% if security_rule.csp_report_only %}-Report-Only{% endif %} "{%
+    add_header Content-Security-Policy{% if security_rule.csp_report_only is defined and security_rule.csp_report_only == '1' %}-Report-Only{% endif %} "{%
     for key, value in hash_csp.items() %}{{ key }} {{ value|join(' ') }}; {% endfor %}{#
     #} report-uri /opnsense-report-csp-violation" always;
 {% endif %}