nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #7781 from SuperTux88/enable-csp-by-default

Browse source 
Enable Content-Security-Policy header by default
This commit is contained in:
Benjamin Neff 2018-06-16 21:20:26 +02:00
commit 299c04a24a
No known key found for this signature in database
GPG key ID: 971464C3F1A90194
3 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Changelog.md
View file

@ -3,6 +3,7 @@
## Refactor ## Refactor
* Add bootstrapping for using ECMAScript 6 with automatic transpiling for compatibility [#7581](https://github.com/diaspora/diaspora/pull/7581) * Add bootstrapping for using ECMAScript 6 with automatic transpiling for compatibility [#7581](https://github.com/diaspora/diaspora/pull/7581)
* Remove backporting of mention syntax [#7788](https://github.com/diaspora/diaspora/pull/7788) * Remove backporting of mention syntax [#7788](https://github.com/diaspora/diaspora/pull/7788)
* Enable Content-Security-Policy header by default [#7781](https://github.com/diaspora/diaspora/pull/7781)
## Bug fixes ## Bug fixes

2
config/defaults.yml
View file

@ -150,7 +150,7 @@ defaults:
title: 'diaspora* social network' title: 'diaspora* social network'
description: 'diaspora* is the online social world where you are in control.' description: 'diaspora* is the online social world where you are in control.'
csp: csp:
report_only: true report_only: false
report_uri: report_uri:
services: services:
facebook: facebook:

8
config/diaspora.yml.example
View file

@ -571,10 +571,10 @@ configuration: ## Section
## is blocked by CSP. ## is blocked by CSP.
csp: csp:
## Report-Only header (default=true) ## Report-Only header (default=false)
## By default diaspora* adds only a "Content-Security-Policy-Report-Only" header. If you set ## By default diaspora* adds a "Content-Security-Policy" header. If you set
## this to false, the "Content-Security-Policy" header is added instead. ## this to true, the "Content-Security-Policy-Report-Only" header is added instead.
#report_only: false #report_only: true
## CSP report URI (default=) ## CSP report URI (default=)
## You can set an URI here, where the user agent reports violations as JSON document via a POST request. ## You can set an URI here, where the user agent reports violations as JSON document via a POST request.