CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Fix syntax fuckup

Browse Source
This commit is contained in:
Raphael Michel
2017-03-07 23:33:45 +01:00
parent 2302dbade6
commit ecd90da554
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/pretix/base/middleware.py
View File

@@ -174,13 +174,13 @@ class SecurityMiddleware(MiddlewareMixin):
'frame-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'], 'frame-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'],
'child-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'], 'child-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'],
'style-src': ["{static}"], 'style-src': ["{static}"],
'connect-src': ["{dynamic}', 'https://checkout.stripe.com"], 'connect-src': ["{dynamic}", "https://checkout.stripe.com"],
'img-src': ["{static}', 'data:', 'https://*.stripe.com"], 'img-src': ["{static}", "data:", "https://*.stripe.com"],
# form-action is not only used to match on form actions, but also on URLs # form-action is not only used to match on form actions, but also on URLs
# form-actions redirect to. In the context of e.g. payment providers or # form-actions redirect to. In the context of e.g. payment providers or
# single-sign-on this can be nearly anything so we cannot really restrict # single-sign-on this can be nearly anything so we cannot really restrict
# this. However, we'll restrict it to HTTPS. # this. However, we'll restrict it to HTTPS.
'form-action': ["{dynamic}', 'https:"], 'form-action': ["{dynamic}", "https:"],
} }
if 'Content-Security-Policy' in resp: if 'Content-Security-Policy' in resp:
_merge_csp(h, _parse_csp(resp['Content-Security-Policy'])) _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))