From 4e408cbc4243153371f982bea228a955a7973c87 Mon Sep 17 00:00:00 2001
From: Tom Misilo <1446856+misilot@users.noreply.github.com>
Date: Wed, 5 May 2021 12:51:47 -0500
Subject: [PATCH 1/2] Fix CSP Always being Enabled unless in debug mode.
 (#9543)

---
 app/Http/Middleware/SecurityHeaders.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Http/Middleware/SecurityHeaders.php b/app/Http/Middleware/SecurityHeaders.php
index 4a75d6ec2..8a3800ffe 100644
--- a/app/Http/Middleware/SecurityHeaders.php
+++ b/app/Http/Middleware/SecurityHeaders.php
@@ -99,7 +99,7 @@ class SecurityHeaders
         // We have to exclude debug mode here because debugbar pulls from a CDN or two
         // and it will break things.
 
-        if ((config('app.debug')!='true')  || (config('app.enable_csp')=='true')) {
+        if ((config('app.debug')!='true')  && (config('app.enable_csp')=='true')) {
             $csp_policy[] = "default-src 'self'";
             $csp_policy[] = "style-src 'self' 'unsafe-inline'";
             $csp_policy[] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'";

From 397e2df3ea53d06986eb953a12d3dcd64c9c4ad7 Mon Sep 17 00:00:00 2001
From: Tom Misilo <1446856+misilot@users.noreply.github.com>
Date: Fri, 7 May 2021 15:50:36 -0500
Subject: [PATCH 2/2] Upgrade the Alpine docker img to v3.13 for PHP 7.4
 (#9550)

v3.13 of the alpine image has php7.4 instead of php7.3
---
 Dockerfile.alpine | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index 64cac8df2..6b52b74f9 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -1,4 +1,4 @@
-FROM alpine:3.12
+FROM alpine:3.13
 # Apache + PHP
 RUN  apk add --no-cache \
         apache2 \