Server: Get rid of inline CSS and remove unsafe-inline gradually from controllers

[LukasReschke]

[rullzer]

So probabaly a good step would be to create a stricter CSP which Apps can then start to use already.

Then we could also start logging warnings on the old CSP.

[sunny75016]

Open almost 4 years. Grateful if the NC cloud can works towards a solution.

[LukasReschke]

@sunny75016 I am sure Pull Requests are appreciated :-)

[sunny75016]

In this thread someone suggested creating a strict CSP. There is my humble suggestion to keep the CSP short. If we replace default-src with 'none', then it becomes too long.

Apache2:
Header set Content-Security-Policy "default-src 'self'; img-src data: 'self'; upgrade-insecure-requests;"

I am not using nginx so someone else can write its equivalent. I hope the suggestion is useful to authors who want to get rid of 'unsafe-inline' from script-src.