web/cryptpad
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

set a more permissive CSP policy by default. add a note about it

Browse Source
This commit is contained in:
ansuz 2017-04-10 18:08:01 +02:00
parent 8ac0741511
commit 2a7793acd8
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
config.js.dist
View File

@ -32,9 +32,14 @@ module.exports = {
* it is recommended that you configure these fields to match the * it is recommended that you configure these fields to match the
* domain which will serve your cryptpad instance. * domain which will serve your cryptpad instance.
*/ */
"connect-src 'self' ws://*",
"child-src 'self' *", "child-src 'self' *",
/* this allows connections over secure or insecure websockets
if you are deploying to production, you'll probably want to remove
the ws://* directive, and change '*' to your domain
*/
"connect-src 'self' ws://* wss://*",
// data: is used by codemirror // data: is used by codemirror
"img-src 'self' data:", "img-src 'self' data:",
].join('; '), ].join('; '),
@ -51,7 +56,9 @@ module.exports = {
* configured for best effect. * configured for best effect.
*/ */
"child-src 'self' *", "child-src 'self' *",
"connect-src 'self' ws://*",
// see the comment above in the 'contentSecurity' section
"connect-src 'self' ws://* wss://*",
// (insecure remote) images are included by users of the wysiwyg who embed photos in their pads // (insecure remote) images are included by users of the wysiwyg who embed photos in their pads
"img-src *", "img-src *",