FIX: Remove strict-dynamic-specific logic from CSP extensions (#25725)

This data is cached, so we don't want to include any site-specific-logic in there. Let's just keep the old URL-collecting behaviour, and let it be stripped out by `CSP::Builder` at runtime.
This commit is contained in:
David Taylor
2024-02-16 13:24:50 +00:00
committed by GitHub
parent 1672a24490
commit 330cb837da

View File

@@ -56,7 +56,6 @@ class ContentSecurityPolicy
ThemeModifierHelper.new(theme_ids: theme_ids).csp_extensions,
)
if !SiteSetting.content_security_policy_strict_dynamic
html_fields =
ThemeField.where(
theme_id: theme_ids,
@@ -89,7 +88,6 @@ class ContentSecurityPolicy
end
extensions << auto_script_src_extension
end
extensions
end