mirror of
https://github.com/discourse/discourse.git
synced 2025-02-28 21:05:27 +08:00
174a8b431b
Raw paths like `/test/path` are not supported natively in the CSP. This commit prepends the site's base URL to these paths. This allows plugins to add 'local' assets to the CSP without needing to hardcode the site's hostname.
14 lines
379 B
Ruby
14 lines
379 B
Ruby
# frozen_string_literal: true
|
|
|
|
# name: csp_extension
|
|
# about: Fixture plugin that extends default CSP
|
|
# version: 1.0
|
|
# authors: xrav3nz
|
|
|
|
extend_content_security_policy(
|
|
script_src: ['https://from-plugin.com', '/local/path'],
|
|
object_src: ['https://test-stripping.com'],
|
|
frame_ancestors: ['https://frame-ancestors-plugin.ext'],
|
|
manifest_src: ['https://manifest-src.com']
|
|
)
|