diff options
| author | Thibaut Girka <thib@sitedethib.com> | 2019-05-04 10:40:32 +0200 |
|---|---|---|
| committer | ThibG <thib@sitedethib.com> | 2019-05-04 10:55:56 +0200 |
| commit | 2c2f649200ba5b742ba9d17ac5ba553c752b59aa (patch) | |
| tree | 26652776cc87eb6745221e9038f88f5815257d56 /config/initializers/content_security_policy.rb | |
| parent | 58720aa2bdc45ec220903e0786984e803c87e8c9 (diff) | |
Fix CSP when PAPERCLIP_ROOT_URL is set to a different host
Diffstat (limited to 'config/initializers/content_security_policy.rb')
| -rw-r--r-- | config/initializers/content_security_policy.rb | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 9da38598b..2fe1a33fa 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -15,8 +15,16 @@ if Rails.env.production? else attachments_host = nil end + data_hosts << attachments_host unless attachments_host.nil? + if ENV['PAPERCLIP_ROOT_URL'] + url = Addressable::URI.parse(assets_host) + ENV['PAPERCLIP_ROOT_URL'] + data_hosts << "https://#{url.host}" + end + + data_hosts.uniq! + Rails.application.config.content_security_policy do |p| p.base_uri :none p.default_src :none |