Merge pull request #1337 from mig5/update_csp

Update the Content-Security-Policy
This commit is contained in:
Micah Lee 2021-04-29 01:24:04 +00:00 committed by GitHub
commit 650bf93128
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -310,7 +310,7 @@ class Web:
if not self.settings.get("website", "disable_csp") or self.mode != "website":
r.headers.set(
"Content-Security-Policy",
"default-src 'self'; style-src 'self'; script-src 'self'; img-src 'self' data:;",
"default-src 'self'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; img-src 'self' data:;",
)
return r