tommy/mobilizon
1
0
Fork 0
forked from potsda.mn/mobilizon
Code Pull requests Activity

Merge branch 'fix-csp-connect-src-webfinger' into 'master'

Browse source 
Allow every origin for connect-src because of Webfinger

Closes #585

See merge request framasoft/mobilizon!826
This commit is contained in:
Thomas Citharel 2021-02-26 11:34:30 +00:00
parent 5f7544eb2e 8508558945
commit fa4e7e090b
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/web/plugs/http_security_plug.ex
View file

@ -52,8 +52,9 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
media_src = ["media-src 'self' "] ++ Config.get([:http_security, :csp_policy, :media_src]) media_src = ["media-src 'self' "] ++ Config.get([:http_security, :csp_policy, :media_src])
# Connect-src is available for any origin because of webfinger query to redirect to content
connect_src = connect_src =
["connect-src 'self' blob: ", static_url, ?\s, websocket_url] ++ ["connect-src 'self' * blob: ", static_url, ?\s, websocket_url] ++
Config.get([:http_security, :csp_policy, :connect_src]) Config.get([:http_security, :csp_policy, :connect_src])
script_src = script_src =