IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FEATURE: allow plugins and themes to extend the default CSP (#6704)

Browse Source 
* FEATURE: allow plugins and themes to extend the default CSP

For plugins:

```
extend_content_security_policy(
  script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'],
  style_src: ['https://domain.com/style.css']
)
```

For themes and components:

```
extend_content_security_policy:
  type: list
  default: "script_src:https://domain.com/|style_src:https://domain.com"
```

* clear CSP base url before each test

we have a test that stubs `Rails.env.development?` to true

* Only allow extending directives that core includes, for now
This commit is contained in:
Kyle Zhao
2018-11-30 09:51:45 -05:00
committed by GitHub
parent 7dec963f2e
commit 488fba3c5f
13 changed files with 384 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spec/components/plugin/instance_spec.rb
View File

@@ -10,8 +10,8 @@ describe Plugin::Instance do
context "find_all" do
it "can find plugins correctly" do
plugins = Plugin::Instance.find_all("#{Rails.root}/spec/fixtures/plugins")
expect(plugins.count).to eq(2)
plugin = plugins[1]
expect(plugins.count).to eq(3)
plugin = plugins[2]
expect(plugin.name).to eq("plugin-name")
expect(plugin.path).to eq("#{Rails.root}/spec/fixtures/plugins/my_plugin/plugin.rb")