Admin Configuration
Contents
This section describes configuration files related to the XP admin console and standard admin tools
Admin
com.enonic.xp.admin.cfg
General settings for /admin.
site.preview.contentSecurityPolicy=site.preview.contentSecurityPolicy=default-src 'self'; base-uri 'self'; form-action 'self'; script-src 'self' maps.googleapis.com; object-src 'none'; img-src * data:; style-src * 'unsafe-inline'; font-src * data:- site.preview.contentSecurityPolicy
-
Defines default value for Content-Security-Policy header for the site engine - when running in Admin Context. The policy is applied in
previewandinlinemode - if the page controllers do not specify a Content-Security-Policy header itself. Default:default-src 'self'; base-uri 'self'; form-action 'self'; script-src 'self'; object-src 'none'; img-src * data:; style-src * 'unsafe-inline'; font-src * data:
XP Dashboard
com.enonic.xp.app.main.cfg
Content Security Policy
| Disabling or changing built-in Content Security Policy is generally NOT RECOMMENDED. You may need to tweak CSP settings only if you are building a Dashboard widget where you want to allow references to external resources (for example, a YouTube video) or other potentially unsafe (from the CSP point of view) actions. |
You can provide your own header for Content Security Policy using contentSecurityPolicy.header property. Note, that if you provide your own header, you should include all necessary directives, as the default headers (self) will not be added.
contentSecurityPolicy.header=default-src 'self'; connect-src 'self' ws: wss:; object-src 'none'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://*.youtube.comTo completely turn off Content Security Policy for the Dashboard, set contentSecurityPolicy.enabled property to false.
contentSecurityPolicy.enabled=falseApplications app
com.enonic.xp.app.applications.cfg
readonlyMode = true- readonlyMode
-
Activate read only mode to prevent installation and stop/start of applications via UI. Default:
false