sjw
/
pleroma
mirror of https://git.pleroma.social/sjw/pleroma.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Plugs.HTTPSecurityPlug: Add webpacker to connect-src

This commit is contained in:
Haelwenn (lanodan) Monnier 2019-02-02 19:06:26 +01:00
parent 00e8f0b07d
commit da4c662af3
No known key found for this signature in database
GPG Key ID: D5B7A8E43C997DEE
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lib/pleroma/plugs/http_security_plug.ex
View File

@ -34,6 +34,21 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
defp csp_string do
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
websocket_url = String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws")
connect_src =
if Mix.env() == :dev do
"connect-src 'self' http://localhost:3035/ " <> websocket_url
else
"connect-src 'self' " <> websocket_url
end
script_src =
if Mix.env() == :dev do
"script-src 'self' 'unsafe-eval'"
else
"script-src 'self'"
end
[
"default-src 'none'",
@ -43,11 +58,9 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
"media-src 'self' https:",
"style-src 'self' 'unsafe-inline'",
"font-src 'self'",
"connect-src 'self' " <> String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws"),
"manifest-src 'self'",
if Mix.env() == :dev do
"script-src 'self' 'unsafe-eval'"
end,
connect_src,
script_src,
if scheme == "https" do
"upgrade-insecure-requests"
end