squeegily/pleroma
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge branch 'bugfix/connect-src-https' into 'develop'

Browse Source 
Plugs.HTTPSecurityPlug: Add static_url to CSP's connect-src

See merge request pleroma/pleroma!900
This commit is contained in:
kaniini 2019-03-06 13:22:02 +00:00
commit 39b766cc43
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/pleroma/plugs/http_security_plug.ex
View File

@ -34,13 +34,16 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
defp csp_string do defp csp_string do
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme] scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
websocket_url = String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws") static_url = Pleroma.Web.Endpoint.static_url()
websocket_url = String.replace(static_url, "http", "ws")
connect_src = "connect-src 'self' #{static_url} #{websocket_url}"
connect_src = connect_src =
if Mix.env() == :dev do if Mix.env() == :dev do
"connect-src 'self' http://localhost:3035/ " <> websocket_url connect_src <> " http://localhost:3035/"
else else
"connect-src 'self' " <> websocket_url connect_src
end end
script_src = script_src =