ThibG
|
e1629a7758
|
Remove 'unsafe-inline' from Content-Security-Policy style-src (#13679)
* Make sure wicg-inert doesn't rely on inline CSS
* Remove unsafe-inline from style-src
|
5 years ago |
|
ThibG
|
dea5db0e25
|
Fix PgHero Content-Security-Policy when CDN_HOST is used (#13595)
|
5 years ago |
|
ThibG
|
7ddbbdea6d
|
Fix OCR not working on Safari because of unsupported worker-src CSP (#13323)
Fixes #13321
|
5 years ago |
|
Thibaut Girka
|
ccaefd139d
|
Add environment variable to specify extra data hosts
Fixes #1276
|
5 years ago |
|
Thibaut Girka
|
9e17f9e95a
|
Fix connect-src policy for Tesseract
|
5 years ago |
|
ThibG
|
8203e24cf4
|
Fix CSP needlessly allowing blob URLs in script-src (#11620)
|
5 years ago |
|
Eugen Rochko
|
b7f5f0ec10
|
Fix media host not being included in connect-src for OCR (#11577)
|
5 years ago |
|
Eugen Rochko
|
28636f43e4
|
Add OCR tool to media editing modal (#11566)
|
5 years ago |
|
Thibaut Girka
|
2c2f649200
|
Fix CSP when PAPERCLIP_ROOT_URL is set to a different host
|
6 years ago |
|
Thibaut Girka
|
58720aa2bd
|
Fix CSP when dealing with S3 hosts
|
6 years ago |
|
Rey Tucker
|
35b2ba5030
|
Remove form_action from CSP
This trips an issue when trying to authenticate through to
third-party sites, e.g. bridge.joinmastodon.org:
Refused to send form data to 'https://bridge.joinmastodon.org/'
because it violates the following Content Security Policy
directive: "form-action 'self'".
Thread: https://vulpine.club/@digifox/101230933751352042
|
6 years ago |
|
Thibaut Girka
|
1283e112b9
|
Tighten CSP a bit
|
6 years ago |
|
ThibG
|
8ab081ec32
|
Add manifest_src to CSP, add blob to connect_src (#8967)
|
6 years ago |
|
Eugen Rochko
|
edc7f895be
|
Fix CSP headers blocking media and development environment (#8962)
Regression from #8957
|
6 years ago |
|
ThibG
|
2d27c11061
|
Set Content-Security-Policy rules through RoR's config (#8957)
* Set CSP rules in RoR's configuration
* Override CSP setting in the embed controller to allow frames
|
6 years ago |
|
Rey Tucker
|
40d04a3209
|
Add manifest_src to CSP
Fixes manifest.json not being loaded because of CSP violation
h/t https://vulpine.club/@binary/100662852252438648
|
6 years ago |
|
Thibaut Girka
|
c4b3479173
|
Fix CSP with S3/SWIFT hosts
|
6 years ago |
|
Thibaut Girka
|
3fe5029fbe
|
Adjust CSP to fix image resizing
|
6 years ago |
|
Thibaut Girka
|
0ddf439999
|
Only apply CSP in production mode
|
6 years ago |
|
Thibaut Girka
|
48db3b3c99
|
Tighten CSP while allowing CDN hosts
|
6 years ago |
|
Thibaut Girka
|
e7a72439f1
|
Move CSP headers to the appropriate Rails configuration
Also drop dev-static.glitch.social reference.
|
6 years ago |
|
Yamagishi Kazutoshi
|
50529cbceb
|
Upgrade Rails to version 5.2.0 (#5898)
|
7 years ago |
