IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

DEV: Only include "report-sample" CSP directive when reporting is enabled (#9337)

Browse Source
This commit is contained in:
Penar Musaraj
2020-04-02 11:16:38 -04:00
committed by GitHub
parent ef7753953d
commit 724d2e99de
4 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/content_security_policy/default.rb
View File

@@ -48,12 +48,12 @@ class ContentSecurityPolicy
def script_src
[
:report_sample,
"#{base_url}/logs/",
"#{base_url}/sidekiq/",
"#{base_url}/mini-profiler-resources/",
*script_assets
].tap do |sources|
sources << :report_sample if SiteSetting.content_security_policy_collect_reports
sources << :unsafe_eval if Rails.env.development? # TODO remove this once we have proper source maps in dev
sources << 'https://www.google-analytics.com/analytics.js' if SiteSetting.ga_universal_tracking_code.present?
sources << 'https://www.googletagmanager.com/gtm.js' if SiteSetting.gtm_container_id.present?