deblan-mirror/thelounge
deblan-mirror/thelounge
1
0
Fork 0
mirror of https://github.com/thelounge/thelounge.git synced 2024-05-17 21:56:36 +02:00
Code Issues Projects Releases Wiki Activity

Make sure data URIs are allowed by CSP not to block video controls

Browse source
This commit is contained in:
Jérémie Astori 2017-12-27 13:56:38 -05:00
parent c17d7bddae
commit dab4fc44ea
No known key found for this signature in database
GPG key ID: B9A4F245CD67BDE8
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/server.js
View file

@ -217,11 +217,13 @@ function index(req, res, next) {
];
// If prefetch is enabled, but storage is not, we have to allow mixed content
// - https://user-images.githubusercontent.com is where we currently push our changelog screenshots
// - data: is required for the HTML5 video player
if (Helper.config.prefetchStorage || !Helper.config.prefetch) {
policies.push("img-src 'self' https://user-images.githubusercontent.com");
policies.push("img-src 'self' data: https://user-images.githubusercontent.com");
policies.unshift("block-all-mixed-content");
} else {
policies.push("img-src http: https:");
policies.push("img-src http: https: data:");
}
res.setHeader("Content-Type", "text/html");