nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix script domain for instagram in CSP header

Browse source 
closes #7920
This commit is contained in:
Benjamin Neff 2018-11-01 20:39:33 +01:00 committed by Dennis Schubert
parent e33466de89
commit 3c55a425c7
No known key found for this signature in database
GPG key ID: 5A0304BEA7966D7E
2 changed files with 14 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Changelog.md
View file

@ -10,6 +10,7 @@
## Bug fixes ## Bug fixes
* Ignore invalid URLs for camo [#7922](https://github.com/diaspora/diaspora/pull/7922) * Ignore invalid URLs for camo [#7922](https://github.com/diaspora/diaspora/pull/7922)
* Unlinking a post did not update the participation icon without a reload [#7882](https://github.com/diaspora/diaspora/pull/7882) * Unlinking a post did not update the participation icon without a reload [#7882](https://github.com/diaspora/diaspora/pull/7882)
* Fix broken Instagram embedding [#7920](https://github.com/diaspora/diaspora/pull/7920)
## Features ## Features
* Add the ability to assign roles in the admin panel [#7868](https://github.com/diaspora/diaspora/pull/7868) * Add the ability to assign roles in the admin panel [#7868](https://github.com/diaspora/diaspora/pull/7868)

26
config/initializers/secure_headers.rb
View file

@ -4,19 +4,19 @@ SecureHeaders::Configuration.default do |config|
config.hsts = SecureHeaders::OPT_OUT # added by Rack::SSL config.hsts = SecureHeaders::OPT_OUT # added by Rack::SSL
csp = { csp = {
default_src: %w('none'), default_src: %w['none'],
connect_src: %w('self' embedr.flickr.com geo.query.yahoo.com nominatim.openstreetmap.org api.github.com), connect_src: %w['self' embedr.flickr.com geo.query.yahoo.com nominatim.openstreetmap.org api.github.com],
font_src: %w('self'), font_src: %w['self'],
form_action: %w('self' platform.twitter.com syndication.twitter.com), form_action: %w['self' platform.twitter.com syndication.twitter.com],
frame_ancestors: %w('self'), frame_ancestors: %w['self'],
frame_src: %w('self' www.youtube.com w.soundcloud.com twitter.com platform.twitter.com syndication.twitter.com frame_src: %w['self' blob: www.youtube.com w.soundcloud.com twitter.com platform.twitter.com
player.vimeo.com www.mixcloud.com www.dailymotion.com media.ccc.de bandcamp.com syndication.twitter.com player.vimeo.com www.mixcloud.com www.dailymotion.com media.ccc.de
www.instagram.com), bandcamp.com www.instagram.com],
img_src: %w('self' data: *), img_src: %w['self' data: blob: *],
media_src: %w(https:), media_src: %w[https:],
script_src: %w('self' 'unsafe-eval' platform.twitter.com cdn.syndication.twimg.com widgets.flickr.com script_src: %w['self' blob: 'unsafe-eval' platform.twitter.com cdn.syndication.twimg.com widgets.flickr.com
embedr.flickr.com platform.instagram.com 'unsafe-inline'), embedr.flickr.com www.instagram.com 'unsafe-inline'],
style_src: %w('self' 'unsafe-inline' platform.twitter.com *.twimg.com) style_src: %w['self' 'unsafe-inline' platform.twitter.com *.twimg.com]
} }
if AppConfig.environment.assets.host.present? if AppConfig.environment.assets.host.present?