namekuji/chuckya
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
11473 commits 8 branches 15 tags 274 MiB
Commit graph

20 commits

Author SHA1 Message Date
Thibaut Girka
ccaefd139d Add environment variable to specify extra data hosts 
Fixes #1276
 2020-02-06 12:15:15 +01:00
Thibaut Girka
9e17f9e95a Fix connect-src policy for Tesseract 2019-08-19 22:02:35 +02:00
Thibaut Girka
1488be7d96 Merge branch 'master' into glitch-soc/merge-upstream 
Conflicts:
- app/controllers/home_controller.rb
- app/controllers/shares_controller.rb
- app/javascript/packs/public.js
- app/models/status.rb
- app/serializers/initial_state_serializer.rb
- app/views/home/index.html.haml
- app/views/layouts/public.html.haml
- app/views/public_timelines/show.html.haml
- app/views/shares/show.html.haml
- app/views/tags/show.html.haml
- config/initializers/content_security_policy.rb
- config/locales/en.yml
- config/webpack/shared.js
- package.json
 2019-08-19 21:49:35 +02:00
Eugen Rochko
b7f5f0ec10
Fix media host not being included in connect-src for OCR (#11577) 2019-08-16 01:54:36 +02:00
Eugen Rochko
28636f43e4
Add OCR tool to media editing modal (#11566) 2019-08-15 15:13:26 +02:00
Thibaut Girka
2c2f649200 Fix CSP when PAPERCLIP_ROOT_URL is set to a different host 2019-05-04 10:55:56 +02:00
Thibaut Girka
58720aa2bd Fix CSP when dealing with S3 hosts 2019-05-04 00:47:51 +02:00
Rey Tucker
35b2ba5030 Remove form_action from CSP 
This trips an issue when trying to authenticate through to
third-party sites, e.g. bridge.joinmastodon.org:

    Refused to send form data to 'https://bridge.joinmastodon.org/'
    because it violates the following Content Security Policy
    directive: "form-action 'self'".

Thread: https://vulpine.club/@digifox/101230933751352042
 2018-12-14 08:02:06 +01:00
Thibaut Girka
1283e112b9 Tighten CSP a bit 2018-11-12 15:43:02 +01:00
Thibaut Girka
dcded13a99 Merge branch 'master' into glitch-soc/merge-upstream 
Conflicts:
- .github/ISSUE_TEMPLATE/bug_report.md
  Took our version.
- CONTRIBUTING.md
  Updated the embedded copy of upstream's version.
- README.md
  Took our version.
- app/policies/status_policy.rb
  Not a real conflict, took code from both.
- app/views/layouts/embedded.html.haml
  Added upstream's changes (dns-prefetch) and fixed
  `%body.embed`
- app/views/settings/preferences/show.html.haml
  Reverted some of upstream changes, as we have a
  page dedicated for flavours and skins.
- config/initializers/content_security_policy.rb
  Kept our version of the CSP.
- config/initializers/doorkeeper.rb
  Not a real conflict, took code from both.
 2018-10-22 17:51:38 +02:00
ThibG
8ab081ec32 Add manifest_src to CSP, add blob to connect_src (#8967) 2018-10-12 19:07:30 +02:00
Eugen Rochko
edc7f895be
Fix CSP headers blocking media and development environment (#8962) 
Regression from #8957
 2018-10-12 01:43:09 +02:00
ThibG
2d27c11061 Set Content-Security-Policy rules through RoR's config (#8957) 
* Set CSP rules in RoR's configuration

* Override CSP setting in the embed controller to allow frames
 2018-10-11 20:35:46 +02:00
Rey Tucker
40d04a3209 Add manifest_src to CSP 
Fixes manifest.json not being loaded because of CSP violation

h/t https://vulpine.club/@binary/100662852252438648
 2018-09-03 22:37:54 +02:00
Thibaut Girka
c4b3479173 Fix CSP with S3/SWIFT hosts 2018-08-28 22:10:40 +02:00
Thibaut Girka
3fe5029fbe Adjust CSP to fix image resizing 2018-08-28 16:58:55 +02:00
Thibaut Girka
0ddf439999 Only apply CSP in production mode 2018-08-23 22:58:40 +02:00
Thibaut Girka
48db3b3c99 Tighten CSP while allowing CDN hosts 2018-08-23 22:58:40 +02:00
Thibaut Girka
e7a72439f1 Move CSP headers to the appropriate Rails configuration 
Also drop dev-static.glitch.social reference.
 2018-08-22 20:39:33 +02:00
Yamagishi Kazutoshi
50529cbceb Upgrade Rails to version 5.2.0 (#5898) 2018-04-12 14:45:17 +02:00