Add csp_additional_header config option

2026-05-05 15:14:04 +00:00 · 2020-12-21 19:15:35 +01:00
parent 06643232cf
commit 8ed41a1276
3 changed files with 9 additions and 1 deletions
--- a/src/pretix/base/middleware.py
+++ b/src/pretix/base/middleware.py
@@ -228,6 +228,8 @@ class SecurityMiddleware(MiddlewareMixin):
            h['report-uri'] = ["/csp_report/"]
        if 'Content-Security-Policy' in resp:
            _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
+        if settings.CSP_ADDITIONAL_HEADER:
+            _merge_csp(h, _parse_csp(settings.CSP_ADDITIONAL_HEADER))

        staticdomain = "'self'"
        dynamicdomain = "'self'"