mirrors/calibre-web
1
0
Fork 0
mirror of https://github.com/janeczku/calibre-web synced 2025-10-23 03:27:37 +00:00
Code Issues Releases Wiki Activity

Make light theme default theme on epub reader

Browse Source 
Fix csp Header for reader and google drive (#3108)
Testrun
This commit is contained in:
Ozzie Isaacs
2024-07-25 21:41:40 +02:00
parent a0728b07d0
commit f8adcbb691
4 changed files with 667 additions and 440 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
cps/web.py
View File

@@ -89,21 +89,21 @@ except ImportError:
def add_security_headers(resp):
default_src = ([host.strip() for host in config.config_trustedhosts.split(',') if host] +
["'self'", "'unsafe-inline'", "'unsafe-eval'"])
csp = "default-src " + ' '.join(default_src) + "; "
csp += "font-src 'self' data:"
csp = "default-src " + ' '.join(default_src)
if request.endpoint == "web.read_book" and config.config_use_google_drive:
csp +=" blob: "
csp += "; font-src 'self' data:"
if request.endpoint == "web.read_book":
csp += " blob:"
csp += " blob: "
csp += "; img-src 'self'"
if request.path.startswith("/author/") and config.config_use_goodreads:
csp += " images.gr-assets.com i.gr-assets.com s.gr-assets.com"
csp += " data:"
if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive:
csp += " *;"
elif request.endpoint == "web.read_book":
csp += " blob:; style-src-elem 'self' blob: 'unsafe-inline';"
else:
csp += ";"
csp += " object-src 'none';"
csp += " *"
if request.endpoint == "web.read_book":
csp += " blob: ; style-src-elem 'self' blob: 'unsafe-inline'"
csp += "; object-src 'none';"
resp.headers['Content-Security-Policy'] = csp
resp.headers['X-Content-Type-Options'] = 'nosniff'
resp.headers['X-Frame-Options'] = 'SAMEORIGIN'