Merge branch 'sw-26367/dev' into '5.7.6'

SW-26367 - Prevent XSS via SVG

See merge request shopware/5/product/shopware!664

Author: Dominik Rathmer

.htaccess

@@ -96,6 +96,12 @@ DirectoryIndex shopware.php
     </IfModule>
 </FilesMatch>
 
+<IfModule mod_headers.c>
+    <FilesMatch "\.(?i:svg)$">
+        Header set Content-Security-Policy "script-src 'none'"
+    </FilesMatch>
+</IfModule>
+
 # Disables auto directory index
 <IfModule mod_autoindex.c>
     Options -Indexes

UPGRADE-5.7.md

@@ -2,6 +2,14 @@
 
 This changelog references changes done in Shopware 5.7 patch versions.
 
+## 5.7.6
+
+[View all changes from v5.7.5...v5.7.6](https://github.com/shopware/shopware/compare/v5.7.5...v5.7.6)
+
+### Additions
+
+* Added a new CSP directive to the default `.htaccess`
+
 ## 5.7.4
 
 [View all changes from v5.7.3...v5.7.4](https://github.com/shopware/shopware/compare/v5.7.3...v5.7.4)