Merge branch 'add-manifest-src-to-csp' into 'develop'

Add manifest-src to CSP to allow manifest.json See merge request pleroma/pleroma!474
2018-11-26 19:56:49 +00:00 · 2018-11-26 19:56:49 +00:00 · 3370924b8b
commit 3370924b8b
parent 39a3b1724a 591b11eafc
1 changed files with 1 additions and 0 deletions
--- a/lib/pleroma/plugs/http_security_plug.ex
+++ b/lib/pleroma/plugs/http_security_plug.ex
@ -39,6 +39,7 @@ defp csp_string do
      "font-src 'self'",
      "script-src 'self'",
      "connect-src 'self' " <> String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws"),
+      "manifest-src 'self'",
      "upgrade-insecure-requests"
    ]
    |> Enum.join("; ")