CSP: Allow extending directives with 'none'

2023-10-08 13:46:32 +02:00
parent 4653e93d13
commit 4879c0172a
1 changed files with 2 additions and 1 deletions
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@ -19,7 +19,8 @@ module CSP
                          else
                            policy.public_send(directive) || []
                          end
-      all_settings = existing_settings + additional_settings
+      all_settings = additional_settings
+      all_settings += existing_settings unless existing_settings == ["'none'"]
      policy.public_send(directive, *all_settings)
    end
  end