skorotkiewicz/rDrama
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update CSP to allow Google Analytics.

Browse source
This commit is contained in:
Ben Rog-Wilhelm 2022-10-19 06:27:14 -05:00 • committed by Ben Rog-Wilhelm
parent f04c79799e
commit 120e299f46
10 changed files with 12 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
files/templates/authforms.html
View file

@ -5,7 +5,7 @@
{% include "analytics.html" %} {% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

2
files/templates/chat.html
View file

@ -4,7 +4,7 @@
{% include "analytics.html" %} {% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

1
files/templates/csp.html Normal file
View file

@ -0,0 +1 @@
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self' *.google-analytics.com *.analytics.google.com; object-src 'none'; img-src 'self' *.google-analytics.com *.analytics.google.com">

2
files/templates/default.html
View file

@ -5,7 +5,7 @@
<link rel="alternate" type="application/rss+xml" title="The Motte RSS" href="/rss"> <link rel="alternate" type="application/rss+xml" title="The Motte RSS" href="/rss">
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' 'unsafe-eval' ajax.cloudflare.com; connect-src 'self' tls-use1.fpapi.io api.fpjs.io {% if PUSHER_ID != 'blahblahblah' %}{{PUSHER_ID}}.pushnotifications.pusher.com{% endif %}; object-src 'none';"> {% include "csp.html" %}
<script src="{{ 'js/bootstrap.js' | asset }}"></script> <script src="{{ 'js/bootstrap.js' | asset }}"></script>
<script src="{{ 'js/micromodal.js' | asset }}"></script> <script src="{{ 'js/micromodal.js' | asset }}"></script>

2
files/templates/login.html
View file

@ -6,7 +6,7 @@
{% include "analytics.html" %} {% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<script src="{{ 'js/bootstrap.js' | asset }}"></script> <script src="{{ 'js/bootstrap.js' | asset }}"></script>

2
files/templates/login_2fa.html
View file

@ -6,7 +6,7 @@
{% include "analytics.html" %} {% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

2
files/templates/settings.html
View file

@ -5,7 +5,7 @@
{% include "analytics.html" %} {% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<script src="{{ 'js/bootstrap.js' | asset }}"></script> <script src="{{ 'js/bootstrap.js' | asset }}"></script>

2
files/templates/sign_up.html
View file

@ -5,7 +5,7 @@
{% include "analytics.html" %} {% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<script src="{{ 'js/bootstrap.js' | asset }}"></script> <script src="{{ 'js/bootstrap.js' | asset }}"></script>

4
files/templates/sign_up_failed_ref.html
View file

@ -3,8 +3,10 @@
<html lang="en"> <html lang="en">
<head> <head>
{% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<script src="{{ 'js/bootstrap.js' | asset }}"></script> <script src="{{ 'js/bootstrap.js' | asset }}"></script>

2
files/templates/submit.html
View file

@ -4,7 +4,7 @@
{% include "analytics.html" %} {% include "analytics.html" %}
<meta name="description" content="{{config('DESCRIPTION')}}"> <meta name="description" content="{{config('DESCRIPTION')}}">
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';"> {% include "csp.html" %}
<script src="{{ 'js/bootstrap.js' | asset }}"></script> <script src="{{ 'js/bootstrap.js' | asset }}"></script>