app/Http/Controllers/ProxyController.php

@@ -187,6 +187,37 @@ class ProxyController extends Controller
             $httpcode = $answer["http-code"];
             extract(parse_url($targetUrl));
             $base = $scheme . "://" . $host;
+
+            $headerArray = [];
+
+            foreach ($answer["headers"] as $index => $value) {
+                if (strtolower($index) === "location") {
+                    $redLink = $value;
+                    if (strpos($redLink, "/") === 0) {
+                        $parse = parse_url($url);
+                        $redLink = $parse["scheme"] . "://" . $parse["host"] . $redLink;
+                    } elseif (preg_match("/^\w+\.\w+$/si", $redLink)) {
+                        $parse = parse_url($url);
+                        $redLink = $parse["scheme"] . "://" . $parse["host"] . "/" . $redLink;
+                    }
+                    
+                    $key = md5($request->ip() . microtime(true));
+                    $headerArray[trim($index)] = $this->proxifyUrl($redLink, null, $key, false);
+                } elseif (strtolower($index) === "content-disposition") {
+                    $headerArray[strtolower(trim($index))] = strtolower(trim($value));
+                } else {
+                    $headerArray[trim($index)] = trim($value);
+                }
+            }
+            $answer["headers"] = $headerArray;
+
+            # It might happen that a server doesn't give Information about file Type.
+            # Let's try to generate one in this case
+            if (!isset($answer["headers"]["content-type"])) {
+                $finfo = new finfo(FILEINFO_MIME);
+                $answer["headers"]["content-type"] = $finfo->buffer(base64_decode($answer["body"]));
+            }
+
             # We will parse whether we have a parser for this document type.
             # If not, we will not Proxy it:
             $contentTypeHeader = $answer["headers"]["content-type"];

config/nginx-default-dev.conf

@@ -4,6 +4,7 @@ server {
     root   /html/public;
     index  index.php index.html index.htm;
 
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline'; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; style-src-attr 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'";
     #charset koi8-r;
     #access_log  /var/log/nginx/host.access.log  main;
 

config/nginx-default.conf

@@ -4,6 +4,7 @@ server {
     root   /html/public;
     index  index.php index.html index.htm;
 
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline'; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; style-src-attr 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'";
     #charset koi8-r;
     #access_log  /var/log/nginx/host.access.log  main;