Forbid eval on legacy responses

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Author: rullzer

lib/private/legacy/response.php

@@ -1,4 +1,5 @@
 <?php
+<?php
 /**
  * @copyright Copyright (c) 2016, ownCloud, Inc.
  *
@@ -84,7 +85,7 @@ public static function addSecurityHeaders() {
 		 * @see \OCP\AppFramework\Http\Response::getHeaders
 		 */
 		$policy = 'default-src \'self\'; '
-			. 'script-src \'self\' \'unsafe-eval\' \'nonce-'.\OC::$server->getContentSecurityPolicyNonceManager()->getNonce().'\'; '
+			. 'script-src \'self\' \'nonce-'.\OC::$server->getContentSecurityPolicyNonceManager()->getNonce().'\'; '
 			. 'style-src \'self\' \'unsafe-inline\'; '
 			. 'frame-src *; '
 			. 'img-src * data: blob:; '