CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-27 13:24:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

SecurityMiddleware: Add child-src

Browse Source
This commit is contained in:
Raphael Michel
2016-09-17 23:18:51 +02:00
parent 9a0967c0e2
commit 852e3cced7
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/base/middleware.py
+3 -1
View File
@@ -157,12 +157,14 @@ class SecurityMiddleware:
'default-src': "{static}", 'default-src': "{static}",
'script-src': '{static} https://checkout.stripe.com https://js.stripe.com', 'script-src': '{static} https://checkout.stripe.com https://js.stripe.com',
'object-src': "'none'", 'object-src': "'none'",
# frame-src is deprecated but kept for compatibility with CSP 1.0 browsers, e.g. Safari 9
'frame-src': '{static} https://checkout.stripe.com https://js.stripe.com', 'frame-src': '{static} https://checkout.stripe.com https://js.stripe.com',
'child-src': '{static} https://checkout.stripe.com https://js.stripe.com',
'style-src': "{static}", 'style-src': "{static}",
'connect-src': "{dynamic} https://checkout.stripe.com", 'connect-src': "{dynamic} https://checkout.stripe.com",
'img-src': "{static} data: https://*.stripe.com", 'img-src': "{static} data: https://*.stripe.com",
# form-action is not only used to match on form actions, but also on URLs # form-action is not only used to match on form actions, but also on URLs
# form-ations redirect to. In the context of e.g. payment providers or # form-actions redirect to. In the context of e.g. payment providers or
# single-sign-on this can be nearly anything so we cannot really restrict # single-sign-on this can be nearly anything so we cannot really restrict
# this. However, we'll restrict it to HTTPS. # this. However, we'll restrict it to HTTPS.
'form-action': "{dynamic} https:", 'form-action': "{dynamic} https:",