fix CSP (#268)
This commit is contained in:
parent
d7b2001716
commit
663b2f91e2
@ -9,7 +9,6 @@ end
|
||||
base_host = Rails.configuration.x.web_domain
|
||||
|
||||
assets_host = Rails.configuration.action_controller.asset_host
|
||||
assets_host ||= "http#{Rails.configuration.x.use_https ? 's' : ''}://#{base_host}"
|
||||
assets_host ||= host_to_url(base_host)
|
||||
|
||||
media_host = host_to_url(ENV['S3_ALIAS_HOST'])
|
||||
@ -21,7 +20,7 @@ Rails.application.config.content_security_policy do |p|
|
||||
p.base_uri :none
|
||||
p.default_src :none
|
||||
p.frame_ancestors :none
|
||||
p.font_src :self, assets_host, google_font_host
|
||||
p.font_src :self, assets_host
|
||||
p.img_src :self, :https, :data, :blob, assets_host
|
||||
p.style_src :self, :unsafe_inline, assets_host
|
||||
p.media_src :self, :https, :data, assets_host
|
||||
|
Loading…
Reference in New Issue
Block a user