Move CSP to config

config

@@ -431,6 +431,9 @@
 # Additional HTTP headers
 #Access-Control-Allow-Origin = *
 
+# Set CSP to disallow execution of unknown javascript
+# This may become the default in future versions, override if you need a different CSP.
+Content-Security-Policy = default-src 'self'; object-src 'none'
 
 [hook]
 

integ_tests/common.py

@@ -53,6 +53,8 @@ type = htpasswd
 htpasswd_filename = {user_path}
 [web]
 type = internal
+[headers]
+Content-Security-Policy = default-src 'self'; object-src 'none'
 [sharing]
 type = csv
 collection_by_map = true

radicale/httputils.py

@@ -200,7 +200,6 @@ def _serve_traversable(
         os.path.splitext(traversable.name)[1].lower(), FALLBACK_MIMETYPE)
     headers = {
         "Content-Type": content_type,
-        "Content-Security-Policy": "default-src 'self'; object-src 'none'"
     }
     if isinstance(traversable, pathlib.Path):
         headers["Last-Modified"] = time.strftime(