squeegily/pleroma
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix CSP: img-src, media-src

Browse Source
This commit is contained in:
Maksim Pechnikov 2020-05-28 21:54:37 +03:00
parent 1d30608e20
commit 9e8b28d2c8
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/pleroma/plugs/http_security_plug.ex
View File

@ -50,7 +50,7 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
end end
defp csp_string do defp csp_string do
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme] scheme = Config.get([Pleroma.Web.Endpoint, :url, :scheme])
static_url = Pleroma.Web.Endpoint.static_url() static_url = Pleroma.Web.Endpoint.static_url()
websocket_url = Pleroma.Web.Endpoint.websocket_url() websocket_url = Pleroma.Web.Endpoint.websocket_url()
report_uri = Config.get([:http_security, :report_uri]) report_uri = Config.get([:http_security, :report_uri])
@ -75,8 +75,8 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
"default-src 'none'", "default-src 'none'",
"base-uri 'self'", "base-uri 'self'",
"frame-ancestors 'none'", "frame-ancestors 'none'",
"img-src 'self' data: blob: https:", "img-src 'self' data: blob: #{scheme}:",
"media-src 'self' https:", "media-src 'self' #{scheme}:",
"style-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline'",
"font-src 'self'", "font-src 'self'",
"manifest-src 'self'", "manifest-src 'self'",