🚀 Release 1.4.4

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 FastSitePHP uses [Semantic Versioning](https://docs.npmjs.com/about-semantic-versioning).
 
+## 1.4.4 (February 1, 2022)
+
+* Commented out the default `CSP (Content-Security-Policy)` and added additional code comments on the topic.
+  * This feature was found to be difficult for initial development when developers try FastSitePHP for the first and are not aware of or do not use CSP.
+  * The original code is still in the file but commented out so it is still easy for developers to add CSP to a site.
+
 ## 1.4.3 (January 5, 2022)
 
 * Added Support for PHP 8.1

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2019 to 2021 Conrad Sollitt and Authors
+Copyright (c) 2019 to 2022 Conrad Sollitt and Authors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -22,7 +22,7 @@
 
 **This is the main Starter Site for FastSitePHP.** It includes several examples pages and provides a basic directory/file structure. The site is designed to provide structure for basic content (JavaScript, CSS, etc) while remaining small in size so that it is easy to remove files you don’t need and customize it for your site.
 
-## :rocket: Getting Started
+## 🚀 Getting Started
 
 **Getting started with PHP and FastSitePHP is extremely easy.** If you do not have PHP installed then see instructions for Windows, Mac, and Linux on the getting started page:
 
@@ -108,28 +108,28 @@ sudo bash create-fast-site.sh
 └── vendor
 ```
 
-## :desktop_computer: Starter Site Print Screens (Screenshots)
+## 🖥️ Starter Site Print Screens (Screenshots)
 
 ![Starter Site Home Page](https://raw.githubusercontent.com/fastsitephp/static-files/master/img/starter_site/2020-01-10/home-page.png)
 
 ![Starter Site Example Page](https://raw.githubusercontent.com/fastsitephp/static-files/master/img/starter_site/2020-01-10/data-page.png)
 
 ![Starter Site Login Page](https://raw.githubusercontent.com/fastsitephp/static-files/master/img/starter_site/2020-01-10/login-page.png)
 
-## :lock: :rocket: Security and Performance
+## 🔒 🚀 Security and Performance
 
 FastSitePHP’s Starter Site is designed to provide strong security using best practices and high performance with the initial template. When using [Chrome DevTools Lighthouse](https://developers.google.com/web/tools/lighthouse) the Starter Site will score 100 in website categories for both Mobile and Desktop. On tested Cloud Systems using low cost servers a score of 100 is also achieved.
 
 ![Chrome DevTools Lighthouse](https://raw.githubusercontent.com/fastsitephp/static-files/master/img/starter_site/2020-08-10/Chrome-DevTools-Lighthouse-Desktop.png)
 
 ![Chrome DevTools Network](https://raw.githubusercontent.com/fastsitephp/static-files/master/img/starter_site/2020-08-10/Chrome-DevTools-Network.png)
 
-## :handshake: Contributing
+## 🤝 Contributing
 
 * If you find a typo or grammar error please fix and submit.
 * If you would like to help with translations then please submit the JSON language files in `app_data/i18n`.
 * If you would like to submit any other changes then please open an issue first. This is intended to be a minimal site so adding more code needs a good reason.
 
-## :memo: License
+## 📝 License
 
 This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

app/app.php

@@ -46,9 +46,19 @@
 // and other code injection attacks. Helpful Links:
 //   https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
 //   https://developers.google.com/web/fundamentals/security/csp
+//
+// Uncomment the code block to turn this feature on. Currently this feature is
+// commented out by default to allow for easier initial development for developers
+// when testing or developing with the Starter Site. If you publish a site that
+// allows users to enter comments or other content then researching and
+// implementing CSP for your site is recommended because it can help
+// prevent users from creating malicious content.
+/*
 $app->onRender(function() use ($app) {
     // By default this is set to work with the current template using strict
     // rules so that only content from the current domain can be included.
+    // This is a very strict policy so it even blocks inline styles such as
+    // <style> and <div style="...."> from being used on a site.
     $app->header('Content-Security-Policy', "default-src 'self'");
 
     // For many sites CDN or other links will typically be included.
@@ -59,6 +69,7 @@
     //
     // $app->header('Content-Security-Policy', "default-src 'self'; style-src 'self' 'unsafe-inline' https://stackpath.bootstrapcdn.com;");
 });
+*/
 
 // ----------------------------------------------------------------------------
 // Routes