hak8or/blog
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Append comments host in CSP

Browse Source
This commit is contained in:
daudix
2024-10-18 20:30:23 +03:00
parent 865c1d2839
commit 732217ccea
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
config.toml
View File

@ -169,9 +169,9 @@ csp = [
{ directive = "style-src", domains = ["'self'", "'unsafe-inline'"] }, { directive = "style-src", domains = ["'self'", "'unsafe-inline'"] },
{ directive = "frame-src", domains = ["https://player.vimeo.com", "https://www.youtube-nocookie.com", "https://toot.community"] }, { directive = "frame-src", domains = ["https://player.vimeo.com", "https://www.youtube-nocookie.com", "https://toot.community"] },
{ directive = "connect-src", domains = ["https://toot.community"] }, { directive = "connect-src", domains = ["https://toot.community"] },
{ directive = "frame-ancestors", domains = ["'self'"] }, { directive = "frame-ancestors", domains = ["'none'"] },
{ directive = "base-uri", domains = ["'self'"] }, { directive = "base-uri", domains = ["'none'"] },
{ directive = "form-action", domains = ["'self'"] }, { directive = "form-action", domains = ["'none'"] },
{ directive = "require-trusted-types-for", domains = ["'script'"] }, { directive = "require-trusted-types-for", domains = ["'script'"] },
] ]
# Display outlines around all elements for debugging purposes # Display outlines around all elements for debugging purposes

6
templates/partials/csp.html
View File

@ -18,6 +18,12 @@ content="default-src 'none';
{%- set connect_src = connect_src ~ " " ~ goatcounter_url -%} {%- set connect_src = connect_src ~ " " ~ goatcounter_url -%}
{%- endif %} {%- endif %}
{#- Append comments host if present -#}
{%- if config.extra.comments -%}
{%- set connect_src = connect_src ~ " " ~ "https://" ~ config.extra.comments.host -%}
{%- endif -%}
{#- Append WebSocket for Zola serve mode -#} {#- Append WebSocket for Zola serve mode -#}
{%- if config.mode == "serve" -%} {%- if config.mode == "serve" -%}
{%- set connect_src = connect_src ~ " ws:" -%} {%- set connect_src = connect_src ~ " ws:" -%}