Commit 9e8b28d2 authored by Maksim's avatar Maksim

fix CSP: img-src, media-src

parent 1d30608e
Pipeline #26511 passed with stages
in 20 minutes and 31 seconds
......@@ -50,7 +50,7 @@ defp headers do
defp csp_string do
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
scheme = Config.get([Pleroma.Web.Endpoint, :url, :scheme])
static_url = Pleroma.Web.Endpoint.static_url()
websocket_url = Pleroma.Web.Endpoint.websocket_url()
report_uri = Config.get([:http_security, :report_uri])
......@@ -75,8 +75,8 @@ defp csp_string do
"default-src 'none'",
"base-uri 'self'",
"frame-ancestors 'none'",
"img-src 'self' data: blob: https:",
"media-src 'self' https:",
"img-src 'self' data: blob: #{scheme}:",
"media-src 'self' #{scheme}:",
"style-src 'self' 'unsafe-inline'",
"font-src 'self'",
"manifest-src 'self'",
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment