Merge remote-tracking branch 'origin/flash-support-csp' into emr_develop

lib/pleroma/web/plugs/http_security_plug.ex

@@ -117,7 +117,9 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
       if Config.get(:env) == :dev do
         "script-src 'self' 'unsafe-eval'"
       else
-        "script-src 'self'"
+        # TODO right now unsafe-eval is needed for WASM to load in chrome
+        # see: https://github.com/WebAssembly/content-security-policy/issues/7
+        "script-src 'self' 'unsafe-eval'"
       end
 
     report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]