From a4afeed4266e75279422a6721f0a9a2aece0b9ea Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 15 Apr 2020 12:05:22 +0200
Subject: [PATCH] Uploads: Sandbox them in the CSP.

---
 lib/pleroma/plugs/uploaded_media.ex | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/pleroma/plugs/uploaded_media.ex b/lib/pleroma/plugs/uploaded_media.ex
index 36ff024a7..94147e0c4 100644
--- a/lib/pleroma/plugs/uploaded_media.ex
+++ b/lib/pleroma/plugs/uploaded_media.ex
@@ -41,6 +41,7 @@ defmodule Pleroma.Plugs.UploadedMedia do
         conn ->
           conn
       end
+      |> merge_resp_headers([{"content-security-policy", "sandbox"}])
 
     config = Pleroma.Config.get(Pleroma.Upload)