Allow https css

Fixed #2012
This commit is contained in:
Al McKinlay 2018-01-30 09:23:34 +00:00
parent 8d124dd2a2
commit 72fafc5b4f

View file

@ -228,7 +228,7 @@ function index(req, res, next) {
"default-src 'none'", // default to nothing
"form-action 'none'", // no default-src fallback
"connect-src 'self' ws: wss:", // allow self for polling; websockets
"style-src 'self' 'unsafe-inline'", // allow inline due to use in irc hex colors
"style-src 'self' https: 'unsafe-inline'", // allow inline due to use in irc hex colors
"script-src 'self'", // javascript
"worker-src 'self'", // service worker
"child-src 'self'", // deprecated fall back for workers, Firefox <58, see #1902