mirrors/calibre-web
1
0
Fork 0
mirror of https://github.com/janeczku/calibre-web synced 2024-11-25 02:57:22 +00:00
Code Issues Releases Wiki Activity

Merge remote-tracking branch 'object_src_csp'

Browse Source
This commit is contained in:
Ozzie Isaacs 2022-12-25 09:27:48 +01:00
commit 389263f5e7
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
cps/web.py
View File

@ -85,7 +85,8 @@ def add_security_headers(resp):
csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' " csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' "
if request.path.startswith("/author/") and config.config_use_goodreads: if request.path.startswith("/author/") and config.config_use_goodreads:
csp += "images.gr-assets.com i.gr-assets.com s.gr-assets.com" csp += "images.gr-assets.com i.gr-assets.com s.gr-assets.com"
csp += " data:" csp += " data:;"
csp += " object-src: 'none';"
resp.headers['Content-Security-Policy'] = csp resp.headers['Content-Security-Policy'] = csp
if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive: if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive:
resp.headers['Content-Security-Policy'] += " *" resp.headers['Content-Security-Policy'] += " *"