add a lax content-security-policy http header - see #905

common.php

@@ -54,6 +54,8 @@ if (!defined('POSTFIXADMIN')) {
 
         // avoid clickjacking attacks?
         header('X-Frame-Options: DENY');
+        // see https://github.com/postfixadmin/postfixadmin/issues/905
+        header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';");
     }
 }