Do not allow JavaScript "eval"

Talk no longer uses JavaScript "eval", so the Content Security Policy
can now be configured to prevent its use.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>

1 files changed, 0 insertions, 2 deletions

diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php
index 2dda1f411..d529de7d4 100644
--- a/lib/Controller/PageController.php
+++ b/lib/Controller/PageController.php
@@ -187,7 +187,6 @@ class PageController extends Controller {
 		$csp = new ContentSecurityPolicy();
 		$csp->addAllowedConnectDomain('*');
 		$csp->addAllowedMediaDomain('blob:');
-		$csp->allowEvalScript();
 		$response->setContentSecurityPolicy($csp);
 		return $response;
 	}
@@ -234,7 +233,6 @@ class PageController extends Controller {
 		$csp = new ContentSecurityPolicy();
 		$csp->addAllowedConnectDomain('*');
 		$csp->addAllowedMediaDomain('blob:');
-		$csp->allowEvalScript(true);
 		$response->setContentSecurityPolicy($csp);
 		return $response;
 	}