CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Allow to turn off CSP reporting

Browse Source
This commit is contained in:
Raphael Michel
2020-06-15 15:11:28 +02:00
parent c992de341f
commit d975a68641
3 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/admin/config.rst
View File

@@ -95,6 +95,8 @@ Example::
proxy that actively removes and re-adds the header to make sure the correct value is set. proxy that actively removes and re-adds the header to make sure the correct value is set.
Defaults to ``off``. Defaults to ``off``.
``csp_log``
Log violations of the Content Security Policy (CSP). Defaults to ``on``.
Locale settings Locale settings
--------------- ---------------

3
src/pretix/base/middleware.py
View File

@@ -212,8 +212,9 @@ class SecurityMiddleware(MiddlewareMixin):
# single-sign-on this can be nearly anything so we cannot really restrict # single-sign-on this can be nearly anything so we cannot really restrict
# this. However, we'll restrict it to HTTPS. # this. However, we'll restrict it to HTTPS.
'form-action': ["{dynamic}", "https:"] + (['http:'] if settings.SITE_URL.startswith('http://') else []), 'form-action': ["{dynamic}", "https:"] + (['http:'] if settings.SITE_URL.startswith('http://') else []),
'report-uri': ["/csp_report/"],
} }
if settings.LOG_CSP:
h['report-uri'] = ["/csp_report/"]
if 'Content-Security-Policy' in resp: if 'Content-Security-Policy' in resp:
_merge_csp(h, _parse_csp(resp['Content-Security-Policy'])) _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))

1
src/pretix/settings.py
View File

@@ -58,6 +58,7 @@ else:
debug_fallback = "runserver" in sys.argv debug_fallback = "runserver" in sys.argv
DEBUG = config.getboolean('django', 'debug', fallback=debug_fallback) DEBUG = config.getboolean('django', 'debug', fallback=debug_fallback)
LOG_CSP = config.getboolean('pretix', 'csp_log', fallback=True)
PDFTK = config.get('tools', 'pdftk', fallback=None) PDFTK = config.get('tools', 'pdftk', fallback=None)