IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FEATURE: Use group based setting for unsafe-none COOP (#27783)

Browse Source 
Followup 3ff7ce78e7

Basing this setting on referrer was too brittle --
the referrer header can easily be ommitted or changed.
Instead, for the small amount of use cases that this
site setting serves, we can use a group-based setting
instead, changing it to `cross_origin_opener_unsafe_none_groups`
instead.
This commit is contained in:
Martin Brennan
2024-07-10 02:25:49 +10:00
committed by GitHub
parent a01be4150a
commit 7a7bdc9be5
4 changed files with 49 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
app/controllers/application_controller.rb
View File

@@ -1023,16 +1023,11 @@ class ApplicationController < ActionController::Base
end
def set_cross_origin_opener_policy_header
response.headers[
"Cross-Origin-Opener-Policy"
] = if SiteSetting.cross_origin_opener_unsafe_none_referrers.present? &&
SiteSetting
.cross_origin_opener_unsafe_none_referrers
.split("|")
.include?(UrlHelper.relaxed_parse(request.referrer.to_s)&.host)
"unsafe-none"
if current_user.present? && SiteSetting.cross_origin_opener_unsafe_none_groups_map.any? &&
current_user.in_any_groups?(SiteSetting.cross_origin_opener_unsafe_none_groups_map)
response.headers["Cross-Origin-Opener-Policy"] = "unsafe-none"
else
SiteSetting.cross_origin_opener_policy_header
response.headers["Cross-Origin-Opener-Policy"] = SiteSetting.cross_origin_opener_policy_header
end
end