Add support for signed URLs used by the render_file function

2022-09-23 11:26:56 +02:00
parent 5881795d5f
commit 16c00ec136
16 changed files with 229 additions and 31 deletions
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@ -38,6 +38,7 @@ Rails.application.config.content_security_policy do |policy|
  # Code executions might return a base64 encoded image as a :data URI
  policy.img_src              :self, :data
  policy.object_src           :none
+  policy.media_src            :self
  policy.script_src           :self, :report_sample
  # Our ACE editor unfortunately requires :unsafe_inline for the code highlighting
  policy.style_src            :self, :unsafe_inline, :report_sample