github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-11-22 01:36:29 -05:00
Code Issues Projects Releases Packages Wiki Activity

CSP: Allow all sources for media

Browse source 
Otherwise, `video` tags and reveal background video
does not work

Signed-off-by: David Mehren <git@herrmehren.de>
This commit is contained in:
David Mehren 2021-08-15 00:35:57 +02:00
parent 8973e85ba6
commit e6d167c63c
No known key found for this signature in database
GPG key ID: 185982BA4C42B7C3
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/csp.js
View file

@ -22,7 +22,8 @@ const defaultDirectives = {
],
styleSrc: [config.serverURL + '/build/', config.serverURL + '/css/', '\'unsafe-inline\'', 'https://github.githubassets.com'], // unsafe-inline is required for some libs, plus used in views
objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/
formAction: ['\'self\'']
formAction: ['\'self\''],
mediaSrc: ['*']
}
const cdnDirectives = {