Adapt CSP for new ToastUi editor

See #2242
2024-04-14 18:47:45 +02:00
parent b37e1b19c3
commit 545dcd0b92
2 changed files with 11 additions and 0 deletions
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@ -60,6 +60,7 @@ Rails.application.configure do
    # Currently, these include turbolinks, and vis.js.
    policy.style_src_elem       :self, :unsafe_inline, :report_sample
    # We still use some inline styles within the application, and indirectly through d3.js.
+    # Further, the ToastUi markdown editor currently requires inline styles, too.
    policy.style_src_attr       :unsafe_inline, :report_sample
    # The `style_src` directive is only a fallback for browsers not supporting `style_src_elem` and `style_src_attr`.
    policy.style_src            :self, :unsafe_inline, :report_sample