Solved CSP bugs

This commit is contained in:
Kevin Veen-Birkenbach 2025-06-18 14:29:16 +02:00
parent 25ba93cbfd
commit 8b5c61953e
No known key found for this signature in database
GPG Key ID: 44D8F11FD62F878E
4 changed files with 17 additions and 12 deletions

View File

@ -102,15 +102,15 @@ hooks:
- exec:
cd: $home/plugins
cmd:
- git clone https://github.com/discourse/docker_manager.git
- git clone https://github.com/discourse/discourse-activity-pub.git
- git clone https://github.com/discourse/discourse-calendar.git
- git clone https://github.com/discourse/discourse-akismet.git
- git clone https://github.com/discourse/discourse-cakeday.git
- git clone https://github.com/discourse/discourse-solved.git
- git clone https://github.com/discourse/discourse-voting.git
- git clone https://github.com/discourse/discourse-oauth2-basic.git
- git clone https://github.com/discourse/discourse-openid-connect.git
- git clone --depth=1 https://github.com/discourse/docker_manager.git
- git clone --depth=1 https://github.com/discourse/discourse-activity-pub.git
- git clone --depth=1 https://github.com/discourse/discourse-calendar.git
- git clone --depth=1 https://github.com/discourse/discourse-akismet.git
- git clone --depth=1 https://github.com/discourse/discourse-cakeday.git
- git clone --depth=1 https://github.com/discourse/discourse-solved.git
- git clone --depth=1 https://github.com/discourse/discourse-voting.git
- git clone --depth=1 https://github.com/discourse/discourse-oauth2-basic.git
- git clone --depth=1 https://github.com/discourse/discourse-openid-connect.git
## Any custom commands to run after building
run:

View File

@ -20,6 +20,8 @@ features:
central_database: true
csp:
flags:
script-src:
unsafe-eval: true
script-src-elem:
unsafe-inline: true
unsafe-eval: true
@ -27,8 +29,7 @@ csp:
unsafe-inline: true
whitelist:
connect-src:
- "{{ primary_domain }}"
- "matrix.{{ primary_domain }}"
- "*"
script-src-elem:
- "element.{{ primary_domain }}"
- "https://cdn.jsdelivr.net"

View File

@ -20,6 +20,8 @@ csp:
unsafe-eval: true
style-src:
unsafe-inline: true
script-src:
unsafe-eval: true
domains:
canonical:
- "kanban.{{ primary_domain }}"

View File

@ -16,6 +16,7 @@ features:
portfolio_iframe: false
oidc: true
central_database: true
version: latest
csp:
flags:
style-src:
@ -31,7 +32,8 @@ csp:
- "data:"
- "https://fonts.bunny.net"
script-src-elem:
- "https://cdn.gtranslate.net"
- "https://cdn.gtranslate.net" # Necessary for translation plugins
- "https://translate.google.com" # Necessary for translation plugins
- "blog.{{ primary_domain }}"
style-src:
- "https://fonts.bunny.net"