nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'next-minor' into develop

Browse source
This commit is contained in:
Benjamin Neff 2017-04-06 01:02:26 +02:00
commit 24b40a4c01
No known key found for this signature in database
GPG key ID: 971464C3F1A90194
3 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Changelog.md
View file

@ -29,6 +29,7 @@
* Cleanup rtl css [#7374](https://github.com/diaspora/diaspora/pull/7374) * Cleanup rtl css [#7374](https://github.com/diaspora/diaspora/pull/7374)
* Increase visual spacing between list items [#7401](https://github.com/diaspora/diaspora/pull/7401) * Increase visual spacing between list items [#7401](https://github.com/diaspora/diaspora/pull/7401)
* Remove unused gem and cucumber step [#7410](https://github.com/diaspora/diaspora/pull/7410) * Remove unused gem and cucumber step [#7410](https://github.com/diaspora/diaspora/pull/7410)
* Disable CSP header when `report_only` and no `report_uri` is set [#7367](https://github.com/diaspora/diaspora/pull/7367)
## Bug fixes ## Bug fixes
* Don't hide posts when blocking someone from the profile [#7379](https://github.com/diaspora/diaspora/pull/7379) * Don't hide posts when blocking someone from the profile [#7379](https://github.com/diaspora/diaspora/pull/7379)

3
config/diaspora.yml.example
View file

@ -561,10 +561,11 @@ configuration: ## Section
## party domains from services that are included in diaspora*, like OEmbed ## party domains from services that are included in diaspora*, like OEmbed
## scripts, so you can safely activate it by setting `report_only` to false. If ## scripts, so you can safely activate it by setting `report_only` to false. If
## you customized diaspora* (edited templates or added own JS), additional work ## you customized diaspora* (edited templates or added own JS), additional work
## may be required. You can test the policy with the "report_uri". Our default CSP ## may be required. You can test the policy with the `report_uri`. Our default CSP
## does not work with Google analytics or Piwik, because they inject JS code that ## does not work with Google analytics or Piwik, because they inject JS code that
## is blocked by CSP. ## is blocked by CSP.
csp: csp:
## Report-Only header (default=true) ## Report-Only header (default=true)
## By default diaspora* adds only a "Content-Security-Policy-Report-Only" header. If you set ## By default diaspora* adds only a "Content-Security-Policy-Report-Only" header. If you set
## this to false, the "Content-Security-Policy" header is added instead. ## this to false, the "Content-Security-Policy" header is added instead.

2
config/initializers/secure_headers.rb
View file

@ -38,7 +38,7 @@ SecureHeaders::Configuration.default do |config|
if AppConfig.settings.csp.report_only? if AppConfig.settings.csp.report_only?
config.csp = SecureHeaders::OPT_OUT config.csp = SecureHeaders::OPT_OUT
config.csp_report_only = csp config.csp_report_only = csp if AppConfig.settings.csp.report_uri.present?
else else
config.csp = csp config.csp = csp
end end