mirrors/pleroma
1
0
Fork 0
mirror of https://git.pleroma.social/pleroma/pleroma.git synced 2024-12-23 00:26:30 +00:00
Code Issues Projects Releases Wiki Activity

Add blob: to connect-src CSP

Browse source
This commit is contained in:
Alex Gleason 2020-05-29 10:33:31 -05:00
parent 9848978109
commit d38f28870e
No known key found for this signature in database
GPG key ID: 7211D1F99744FBB7
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
CHANGELOG.md
View file

@ -44,6 +44,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Fix follower/blocks import when nicknames starts with @ - Fix follower/blocks import when nicknames starts with @
- Filtering of push notifications on activities from blocked domains - Filtering of push notifications on activities from blocked domains
- Resolving Peertube accounts with Webfinger - Resolving Peertube accounts with Webfinger
- `blob:` urls not being allowed by connect-src CSP
## [Unreleased (patch)] ## [Unreleased (patch)]

2
lib/pleroma/plugs/http_security_plug.ex
View file

@ -78,7 +78,7 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
{img_src, media_src} {img_src, media_src}
end end
connect_src = ["connect-src 'self' ", static_url, ?\s, websocket_url] connect_src = ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
connect_src = connect_src =
if Pleroma.Config.get(:env) == :dev do if Pleroma.Config.get(:env) == :dev do