Merge remote-tracking branch 'trustedhost/master'

2021-10-30 09:40:04 +02:00
parent 4b7b646692 c6bf62a6eb
commit bbb65ec804
4 changed files with 7 additions and 3 deletions
@@ -82,7 +82,7 @@ except ImportError:

@app.after_request
 def add_security_headers(resp):
-    resp.headers['Content-Security-Policy'] = "default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:"
+    resp.headers['Content-Security-Policy'] = "default-src 'self'" + ''.join([' '+host for host in config.config_trustedhosts.strip().split(',')]) + " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:"
    if request.endpoint == "editbook.edit_book" or config.config_use_google_drive:
        resp.headers['Content-Security-Policy'] += " *"
    resp.headers['X-Content-Type-Options'] = 'nosniff'