CSP breaks when new line characters are in the fields about wordpress-csp-manager HOT 4 CLOSED

Thanks for pointing this out. I had a similar report on the WordPress Forums, just did not have time to look into either of these until now. Planning on implementing it for the next update, along with a overall improved handling of the header output to prevent issues like this.

Not sure if it is best to remove newlines when saved or when outputting the header though. Do you have any opinion on this? Would you expect newlines in the text fields to be preserved after save?

from wordpress-csp-manager.

I'd prefer to remove any newlines when saved. I'm not sure if maybe some UX changes would help? When adding to some of the fields, if there are a lot of urls, they trail off into the input box. Maybe some form of array input (click button to add another element) might work?

Either way, thanks for making this plug-in, it makes it way easier to handle the csp header rather than in nginx config or something similar.

from wordpress-csp-manager.

Glad you like it! I've been thinking of a more intuitive UI, something like the array input you suggest, but it would be a significant amount of work. For the moment I'll focus on this sanitization issue though.

from wordpress-csp-manager.

I believe I intended to close this with #5 back in October. Let me know if there still are issues

from wordpress-csp-manager.