All: switch CSP headers from report-only to enforced

timmywil · web-flow · commit 57ec3597124f · 2025-01-13T22:56:35.000-05:00
Ref jquery/infrastructure-puppet#54 Closes gh-11
diff --git a/jquery/functions.php b/jquery/functions.php
@@ -314,7 +314,7 @@ function twentyeleven_content_security_policy() {
 	}
 
 	header( 'Reporting-Endpoints: csp-endpoint="' . $report_url . '"' );
-	header( 'Content-Security-Policy-Report-Only: ' . $policy_string );
+	header( 'Content-Security-Policy: ' . $policy_string );
 }
 
 add_action( 'send_headers', 'twentyeleven_content_security_policy' );

Original file line number	Diff line number	Diff line change
`@@ -314,7 +314,7 @@ function twentyeleven_content_security_policy() {`
`314`	`314`	`}`
`315`	`315`
`316`	`316`	`header( 'Reporting-Endpoints: csp-endpoint="' . $report_url . '"' );`
`317`		`- header( 'Content-Security-Policy-Report-Only: ' . $policy_string );`
	`317`	`+ header( 'Content-Security-Policy: ' . $policy_string );`
`318`	`318`	`}`
`319`	`319`
`320`	`320`	`add_action( 'send_headers', 'twentyeleven_content_security_policy' );`