scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2024-09-20 14:45:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

Define allowed scripts src-elem for CSP [SCI-8634] (#5771)

Browse source
This commit is contained in:
Soufiane 2023-07-14 14:25:24 +02:00 committed by GitHub
parent ebe1bd583f
commit 51a19a559b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
config/initializers/content_security_policy.rb
View file

@ -12,6 +12,7 @@ ActiveSupport::Reloader.to_prepare do
policy.img_src :self, :https, :data, :blob
policy.object_src :none
policy.script_src :self, :unsafe_eval
policy.script_src_elem :self, *Extends::EXTERNAL_SERVICES
policy.style_src :self, :https, :unsafe_inline, :data
policy.connect_src :self, :data, *Extends::EXTERNAL_SERVICES