Merge remote-tracking branch 'glitch/master' into production

1 files changed, 11 insertions, 1 deletions

diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 12b764a5a..2fe1a33fa 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -7,14 +7,24 @@ if Rails.env.production?
   data_hosts = [assets_host]
 
   if ENV['S3_ENABLED'] == 'true'
-    attachments_host = ENV['S3_ALIAS_HOST'] || ENV['S3_CLOUDFRONT_HOST'] || ENV['S3_HOSTNAME'] || "s3-#{ENV['S3_REGION'] || 'us-east-1'}.amazonaws.com"
+    attachments_host = "https://#{ENV['S3_ALIAS_HOST'] || ENV['S3_CLOUDFRONT_HOST'] || ENV['S3_HOSTNAME'] || "s3-#{ENV['S3_REGION'] || 'us-east-1'}.amazonaws.com"}"
+    attachments_host = "https://#{Addressable::URI.parse(attachments_host).host}"
   elsif ENV['SWIFT_ENABLED'] == 'true'
     attachments_host = ENV['SWIFT_OBJECT_URL']
+    attachments_host = "https://#{Addressable::URI.parse(attachments_host).host}"
   else
     attachments_host = nil
   end
+
   data_hosts << attachments_host unless attachments_host.nil?
 
+  if ENV['PAPERCLIP_ROOT_URL']
+    url = Addressable::URI.parse(assets_host) + ENV['PAPERCLIP_ROOT_URL']
+    data_hosts << "https://#{url.host}"
+  end
+
+  data_hosts.uniq!
+
   Rails.application.config.content_security_policy do |p|
     p.base_uri        :none
     p.default_src     :none