From f5a1ed0243c1f617ed73fd2ce1015f5ed7f0a582 Mon Sep 17 00:00:00 2001
From: DariusIII <dkrisan@gmail.com>
Date: Sun, 20 Oct 2024 17:48:18 +0200
Subject: [PATCH] Add spatie/laravel-csp package

---
 .env.example               |  2 +
 app/Policies/CustomCsp.php |  1 -
 bootstrap/app.php          |  5 ++-
 composer.json              |  3 +-
 composer.lock              | 84 +++++++++++++++++++++++++++++++++++++-
 5 files changed, 91 insertions(+), 4 deletions(-)

diff --git a/.env.example b/.env.example
index ec64fff47..ea2eef357 100644
--- a/.env.example
+++ b/.env.example
@@ -184,3 +184,5 @@ PURGE_INACTIVE_USERS=false
 OTP_ENABLED=false
 
 FLARE_KEY=
+
+CSP_ENABLED=false   # Content Security Policy
diff --git a/app/Policies/CustomCsp.php b/app/Policies/CustomCsp.php
index c2d734d7f..49932c8a9 100644
--- a/app/Policies/CustomCsp.php
+++ b/app/Policies/CustomCsp.php
@@ -2,7 +2,6 @@
 
 namespace App\Policies;
 
-
 use Spatie\Csp\Directive;
 use Spatie\Csp\Policies\Basic;
 
diff --git a/bootstrap/app.php b/bootstrap/app.php
index bcbf0593e..8ffa85a5c 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -37,7 +37,10 @@ return Application::configure(basePath: dirname(__DIR__))
             \App\Http\Middleware\ForceJsonOnAPI::class,
         ]);
 
-        $middleware->web(\Illuminate\Session\Middleware\AuthenticateSession::class);
+        $middleware->web([
+            \Illuminate\Session\Middleware\AuthenticateSession::class,
+            \Spatie\Csp\AddCspHeaders::class,
+        ]);
 
         $middleware->throttleApi('60,1');
 
diff --git a/composer.json b/composer.json
index 641e731b6..55098ac23 100644
--- a/composer.json
+++ b/composer.json
@@ -52,6 +52,7 @@
         "dariusiii/php-itunes-api": "^1.0",
         "dariusiii/rarinfo": "^2.7",
         "dariusiii/tmdb-laravel": "^7.0",
+        "dariusiii/tv-maze-php-api": "^2.0.0",
         "dborsatto/php-giantbomb": "^2.2",
         "divineomega/php-cli-progress-bar": "^2.1",
         "fakerphp/faker": "^1.23",
@@ -61,7 +62,6 @@
         "guzzlehttp/guzzle": "^7.9",
         "imdbphp/imdbphp": "^8.2",
         "intervention/image": "^3.8",
-        "dariusiii/tv-maze-php-api": "^2.0.0",
         "jrean/laravel-user-verification": "^12.0",
         "junaidnasir/larainvite": "^7.0",
         "kevinlebrun/colors.php": "^1.0",
@@ -99,6 +99,7 @@
         "sentry/sentry-laravel": "^4.9",
         "smarty/smarty": "^4.3",
         "spatie/async": "^1.6",
+        "spatie/laravel-csp": "^2.10",
         "spatie/laravel-directory-cleanup": "^1.10",
         "spatie/laravel-fractal": "^6.2",
         "spatie/laravel-ignition": "^2.8",
diff --git a/composer.lock b/composer.lock
index 5969e4e0d..2388c0efd 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "a562e8a2efe6ac0352b38ca0b42ccdf7",
+    "content-hash": "d7e5cc0b1eccdea5a9ee63f2e045cccf",
     "packages": [
         {
             "name": "aharen/omdbapi",
@@ -9685,6 +9685,88 @@
             },
             "time": "2024-05-16T08:48:33+00:00"
         },
+        {
+            "name": "spatie/laravel-csp",
+            "version": "2.10.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/spatie/laravel-csp.git",
+                "reference": "ea7d2859a2617954df869e816b0f740400184ae0"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/spatie/laravel-csp/zipball/ea7d2859a2617954df869e816b0f740400184ae0",
+                "reference": "ea7d2859a2617954df869e816b0f740400184ae0",
+                "shasum": ""
+            },
+            "require": {
+                "illuminate/http": "^9.0|^10.0|^11.0",
+                "illuminate/support": "^9.0|^10.0|^11.0",
+                "php": "^8.1",
+                "spatie/laravel-package-tools": "^1.11"
+            },
+            "require-dev": {
+                "mockery/mockery": "^1.3.3",
+                "orchestra/testbench": "^7.0|^8.0|^9.0",
+                "pestphp/pest": "^1.23.0|^2.34.0",
+                "roave/security-advisories": "dev-master"
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "providers": [
+                        "Spatie\\Csp\\CspServiceProvider"
+                    ]
+                }
+            },
+            "autoload": {
+                "files": [
+                    "src/helpers.php"
+                ],
+                "psr-4": {
+                    "Spatie\\Csp\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Thomas Verhelst",
+                    "email": "tvke91@gmail.com",
+                    "homepage": "https://spatie.be",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Freek Van der Herten",
+                    "email": "freek@spatie.be",
+                    "homepage": "https://spatie.be",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Add CSP headers to the responses of a Laravel app",
+            "homepage": "https://github.com/spatie/laravel-csp",
+            "keywords": [
+                "content-security-policy",
+                "csp",
+                "headers",
+                "laravel",
+                "laravel-csp",
+                "security",
+                "spatie"
+            ],
+            "support": {
+                "source": "https://github.com/spatie/laravel-csp/tree/2.10.1"
+            },
+            "funding": [
+                {
+                    "url": "https://spatie.be/open-source/support-us",
+                    "type": "custom"
+                }
+            ],
+            "time": "2024-09-20T13:39:37+00:00"
+        },
         {
             "name": "spatie/laravel-directory-cleanup",
             "version": "1.10.0",