krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-14 05:07:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(CSP): move trusted list to default-src

Browse Source
This commit is contained in:
Kalista Payne
2025-12-12 16:52:14 -06:00
parent 83b2ba7688
commit f51f0a0c93
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
website/server/middlewares/index.js
View File

@@ -69,19 +69,17 @@ export default function attachMiddlewares (app, server) {
contentSecurityPolicy: { contentSecurityPolicy: {
directives: { directives: {
defaultSrc: [ defaultSrc: [
'*.habitica.com',
'*.amazonaws.com', '*.amazonaws.com',
],
imgSrc: null,
scriptSrc: [
'\'unsafe-eval\'',
'*.habitica.com', '*.habitica.com',
'*.amazonaws.com',
'cloudfront.loggly.com', 'cloudfront.loggly.com',
'js.stripe.com', 'js.stripe.com',
'm.stripe.network', 'm.stripe.network',
'static-na.payments-amazon.com', 'static-na.payments-amazon.com',
], ],
imgSrc: '*',
scriptSrc: [
'\'unsafe-eval\'',
],
upgradeInsecureRequests: IS_PROD ? [] : null, upgradeInsecureRequests: IS_PROD ? [] : null,
}, },
}, },