mirror of
https://github.com/janeczku/calibre-web
synced 2024-12-25 09:30:31 +00:00
Add object-src to the CSP policy
This commit is contained in:
parent
3d59a78c9f
commit
2ddbaa2150
@ -85,7 +85,8 @@ def add_security_headers(resp):
|
||||
csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' "
|
||||
if request.path.startswith("/author/") and config.config_use_goodreads:
|
||||
csp += "images.gr-assets.com i.gr-assets.com s.gr-assets.com"
|
||||
csp += " data:"
|
||||
csp += " data:;"
|
||||
csp += " object-src: 'none';"
|
||||
resp.headers['Content-Security-Policy'] = csp
|
||||
if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive:
|
||||
resp.headers['Content-Security-Policy'] += " *"
|
||||
|
Loading…
Reference in New Issue
Block a user