===================================================================
RCS file: /cvs/cvsweb/cvsweb.cgi,v
retrieving revision 4.9
retrieving revision 4.12
diff -u -p -r4.9 -r4.12
--- cvsweb/cvsweb.cgi	2019/11/09 10:06:23	4.9
+++ cvsweb/cvsweb.cgi	2019/11/10 14:55:42	4.12
@@ -1,5 +1,5 @@
 #!/usr/bin/perl
-# $Id: cvsweb.cgi,v 4.9 2019/11/09 10:06:23 schwarze Exp $
+# $Id: cvsweb.cgi,v 4.12 2019/11/10 14:55:42 schwarze Exp $
 # $knu: cvsweb.cgi,v 1.299 2010/11/13 16:37:18 simon
 #
 # cvsweb - a CGI interface to CVS trees.
@@ -765,6 +765,7 @@ if ($input{tarball}) {
   }
 
   # Clean up.
+  chdir("..");
   rmtree($tmpexportdir);
 
   &fatal(@fatal) if @fatal;
@@ -4242,6 +4243,8 @@ sub http_header(;$$)
   push(@headers, 'Last-Modified: ' . scalar gmtime($moddate) . ' GMT')
     if $moddate;
   push(@headers, 'Content-Type: ' . $content_type);
+  push(@headers, "Content-Security-Policy: default-src 'none'; " .
+    "img-src 'self'; style-src 'unsafe-inline'");
 
   if ($allow_compress && $maycompress) {
     if (HAS_ZLIB
@@ -4434,7 +4437,7 @@ sub TIEHANDLE
               crc    => 0,
               len    => 0,
             };
-  my ($header) = pack("c10",
+  my ($header) = pack("C10",
                       MAGIC1, MAGIC2, Compress::Zlib::Z_DEFLATED(),
                       0, 0, 0, 0, 0, 0, OSCODE);
   print {$o->{handle}} $header;