IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Don't reuse CSP nonce between anonymous requests

Browse Source
This commit is contained in:
OsamaSayegh
2023-07-28 12:53:44 +01:00
committed by David Taylor
parent 672f3e7e41
commit 0976c8fad6
15 changed files with 105 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config/application.rb
View File

@@ -167,6 +167,9 @@ module Discourse
config.middleware.swap ActionDispatch::ContentSecurityPolicy::Middleware,
ContentSecurityPolicy::Middleware
require "middleware/gtm_script_nonce_injector"
config.middleware.insert_after(ActionDispatch::Flash, Middleware::GtmScriptNonceInjector)
require "middleware/discourse_public_exceptions"
config.exceptions_app = Middleware::DiscoursePublicExceptions.new(Rails.public_path)