user01/calibre-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

The recent changes to content security policy broke custom theming. I fixed it by adding a trusted hosts field to Server Configuration

Browse Source
This commit is contained in:
cbartondock
2021-10-22 15:35:10 -04:00
parent 95544ef885
commit c6bf62a6eb
4 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cps/web.py
View File

@@ -82,7 +82,7 @@ except ImportError:
@app.after_request
def add_security_headers(resp):
resp.headers['Content-Security-Policy'] = "default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:"
resp.headers['Content-Security-Policy'] = "default-src 'self'" + ''.join([' '+host for host in config.config_trustedhosts.strip().split(',')]) + " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:"
if request.endpoint == "editbook.edit_book" or config.config_use_google_drive:
resp.headers['Content-Security-Policy'] += " *"
resp.headers['X-Content-Type-Options'] = 'nosniff'