ccaefd139d
Add environment variable to specify extra data hosts
...
Fixes #1276
5 years ago
9e17f9e95a
Fix connect-src policy for Tesseract
5 years ago
1488be7d96
Merge branch 'master' into glitch-soc/merge-upstream
...
Conflicts:
- app/controllers/home_controller.rb
- app/controllers/shares_controller.rb
- app/javascript/packs/public.js
- app/models/status.rb
- app/serializers/initial_state_serializer.rb
- app/views/home/index.html.haml
- app/views/layouts/public.html.haml
- app/views/public_timelines/show.html.haml
- app/views/shares/show.html.haml
- app/views/tags/show.html.haml
- config/initializers/content_security_policy.rb
- config/locales/en.yml
- config/webpack/shared.js
- package.json
5 years ago
b7f5f0ec10
Fix media host not being included in connect-src for OCR ( #11577 )
5 years ago
28636f43e4
Add OCR tool to media editing modal ( #11566 )
5 years ago
2c2f649200
Fix CSP when PAPERCLIP_ROOT_URL is set to a different host
6 years ago
58720aa2bd
Fix CSP when dealing with S3 hosts
6 years ago
35b2ba5030
Remove form_action from CSP
...
This trips an issue when trying to authenticate through to
third-party sites, e.g. bridge.joinmastodon.org:
Refused to send form data to 'https://bridge.joinmastodon.org/ '
because it violates the following Content Security Policy
directive: "form-action 'self'".
Thread: https://vulpine.club/@digifox/101230933751352042
6 years ago
1283e112b9
Tighten CSP a bit
6 years ago
dcded13a99
Merge branch 'master' into glitch-soc/merge-upstream
...
Conflicts:
- .github/ISSUE_TEMPLATE/bug_report.md
Took our version.
- CONTRIBUTING.md
Updated the embedded copy of upstream's version.
- README.md
Took our version.
- app/policies/status_policy.rb
Not a real conflict, took code from both.
- app/views/layouts/embedded.html.haml
Added upstream's changes (dns-prefetch) and fixed
`%body.embed`
- app/views/settings/preferences/show.html.haml
Reverted some of upstream changes, as we have a
page dedicated for flavours and skins.
- config/initializers/content_security_policy.rb
Kept our version of the CSP.
- config/initializers/doorkeeper.rb
Not a real conflict, took code from both.
6 years ago
8ab081ec32
Add manifest_src to CSP, add blob to connect_src ( #8967 )
6 years ago
edc7f895be
Fix CSP headers blocking media and development environment ( #8962 )
...
Regression from #8957
6 years ago
2d27c11061
Set Content-Security-Policy rules through RoR's config ( #8957 )
...
* Set CSP rules in RoR's configuration
* Override CSP setting in the embed controller to allow frames
6 years ago
40d04a3209
Add manifest_src to CSP
...
Fixes manifest.json not being loaded because of CSP violation
h/t https://vulpine.club/@binary/100662852252438648
6 years ago
c4b3479173
Fix CSP with S3/SWIFT hosts
6 years ago
3fe5029fbe
Adjust CSP to fix image resizing
6 years ago
0ddf439999
Only apply CSP in production mode
6 years ago
48db3b3c99
Tighten CSP while allowing CDN hosts
6 years ago
e7a72439f1
Move CSP headers to the appropriate Rails configuration
...
Also drop dev-static.glitch.social reference.
6 years ago
50529cbceb
Upgrade Rails to version 5.2.0 ( #5898 )
7 years ago
Thibaut Girka
Eugen Rochko
Rey Tucker
Yamagishi Kazutoshi