cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't try and modify policy if we don't have one

Browse source
This commit is contained in:
Tom Hughes 2017-03-02 10:39:18 +00:00
parent 460a8a106b
commit ee12eba234
1 changed files with 20 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

40
config/initializers/secure_headers.rb
View file

@ -1,24 +1,24 @@
policy = if defined?(CSP_REPORT_URL)
{
:default_src => %w('self'),
:child_src => %w('self'),
:connect_src => %w('self'),
:font_src => %w('none'),
:form_action => %w('self'),
:frame_ancestors => %w('self'),
:img_src => %w('self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr),
:media_src => %w('none'),
:object_src => %w('self'),
:plugin_types => %w('none'),
:script_src => %w('self'),
:style_src => %w('self' 'unsafe-inline'),
:report_uri => [CSP_REPORT_URL]
}
else
SecureHeaders::OPT_OUT
end
if defined?(CSP_REPORT_URL)
policy = {
:default_src => %w('self'),
:child_src => %w('self'),
:connect_src => %w('self'),
:font_src => %w('none'),
:form_action => %w('self'),
:frame_ancestors => %w('self'),
:img_src => %w('self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr),
:media_src => %w('none'),
:object_src => %w('self'),
:plugin_types => %w('none'),
:script_src => %w('self'),
:style_src => %w('self' 'unsafe-inline'),
:report_uri => [CSP_REPORT_URL]
}
policy[:script_src] << PIWIK["location"] if defined?(PIWIK)
policy[:script_src] << PIWIK["location"] if defined?(PIWIK)
else
policy = SecureHeaders::OPT_OUT
end
SecureHeaders::Configuration.default do |config|
config.csp = SecureHeaders::OPT_OUT