From 14aae003844f2208bd64f9cc4897d07d82c527e6 Mon Sep 17 00:00:00 2001
From: Fabian Franz BSc <fabianfrz@users.noreply.github.com>
Date: Mon, 11 Mar 2019 18:30:04 +0100
Subject: [PATCH] www/nginx: bugfix csp (#1243)

* www/nginx: fix content security settings

* www/nginx: fix content security settings

* www/nginx: fix content security settings

* Update www/nginx/pkg-descr

Co-Authored-By: fabianfrz <fabianfrz@users.noreply.github.com>
---
 www/nginx/pkg-descr                                         | 4 ++++
 .../controllers/OPNsense/Nginx/forms/security_headers.xml   | 6 ++++++
 .../service/templates/OPNsense/Nginx/security_rule.conf     | 2 +-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index a8edd27c2..9634f9658 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -8,6 +8,10 @@ reuse, SSL offload and HTTP media streaming.
 Plugin Changelog
 ================
 
+1.10
+
+* fix content security settings (missing checkbox, correct templating)
+
 1.9
 
 * add advanced options to configure hostname hash sizes for long hostnames
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml
index 78e7c40dd..f4004ea58 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml
@@ -82,6 +82,12 @@
     <type>checkbox</type>
     <help>If checked, the CSP is enabled.</help>
   </field>
+  <field>
+    <id>security_header.csp_report_only</id>
+    <label>Content Security Policy: Report Only</label>
+    <type>checkbox</type>
+    <help>If checked, the CSP is not enforced (learning mode).</help>
+  </field>
   <field>
     <type>header</type>
     <label>Content Security Policy: Default Source</label>
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf
index d5c5bc08d..354db6121 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf
@@ -67,7 +67,7 @@
 {%   endfor %}
 {% do our_headers.append('Content-Security-Policy') %}
 {% do our_headers.append('Content-Security-Policy-Report-Only') %}
-    add_header Content-Security-Policy{% if security_rule.csp_report_only %}-Report-Only{% endif %} "{%
+    add_header Content-Security-Policy{% if security_rule.csp_report_only is defined and security_rule.csp_report_only == '1' %}-Report-Only{% endif %} "{%
     for key, value in hash_csp.items() %}{{ key }} {{ value|join(' ') }}; {% endfor %}{#
     #} report-uri /opnsense-report-csp-violation" always;
 {% endif %}