Unfloyded/Legamunt
0
0
Fork 0
Code Activity

fix: CSP

Browse source
This commit is contained in:
무라쿠모 2024-09-27 20:04:33 +09:00
parent f9ef8f3250
commit 8b9985c5ce
No known key found for this signature in database
GPG key ID: 139D6573F92DA9F7
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
config/initializers/content_security_policy.rb
View file

@ -16,7 +16,7 @@ Rails.application.config.content_security_policy do |p|
p.base_uri :none
p.default_src :none
p.frame_ancestors :none
p.font_src :self, assets_host
p.font_src :self, :blob, assets_host, :unsafe_inline, *media_hosts
p.img_src :self, :data, :blob, *media_hosts
p.style_src :self, assets_host, *media_hosts
p.media_src :self, :data, *media_hosts
@ -28,8 +28,8 @@ Rails.application.config.content_security_policy do |p|
p.form_action :self
end
p.child_src :self, :blob, assets_host
p.worker_src :self, :blob, assets_host
p.child_src :self, :blob, assets_host, :unsafe_inline, *media_hosts
p.worker_src :self, :blob, assets_host, :unsafe_inline, *media_hosts
if Rails.env.development?
webpacker_public_host = ENV.fetch('WEBPACKER_DEV_SERVER_PUBLIC', Webpacker.config.dev_server[:public])
@ -66,7 +66,7 @@ Rails.application.reloader.to_prepare do
if Rails.env.development?
LetterOpenerWeb::LettersController.content_security_policy do |p|
p.child_src :self
p.child_src :self, :unsafe_inline, *media_hosts
p.connect_src :none
p.frame_ancestors :self
p.frame_src :self