mirror of
https://github.com/discourse/discourse.git
synced 2025-02-25 18:55:32 -06:00
FIX: Remove strict-dynamic-specific logic from CSP extensions (#25725)
This data is cached, so we don't want to include any site-specific-logic in there. Let's just keep the old URL-collecting behaviour, and let it be stripped out by `CSP::Builder` at runtime.
This commit is contained in:
@@ -56,7 +56,6 @@ class ContentSecurityPolicy
|
||||
ThemeModifierHelper.new(theme_ids: theme_ids).csp_extensions,
|
||||
)
|
||||
|
||||
if !SiteSetting.content_security_policy_strict_dynamic
|
||||
html_fields =
|
||||
ThemeField.where(
|
||||
theme_id: theme_ids,
|
||||
@@ -89,7 +88,6 @@ class ContentSecurityPolicy
|
||||
end
|
||||
|
||||
extensions << auto_script_src_extension
|
||||
end
|
||||
|
||||
extensions
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user