CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-20 12:26:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

CSP: Do not set nonce if unsafe-inline is set

Browse Source
This commit is contained in:
Raphael Michel
2022-12-19 14:52:58 +01:00
parent 52f6b7c971
commit c8983ca863
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/base/middleware.py
+5
View File
@@ -224,6 +224,11 @@ def _merge_csp(a, b):
if k not in a: if k not in a:
a[k] = b[k] a[k] = b[k]
for k, v in a.items():
if "'unsafe-inline'" in v:
# If we need unsafe-inline, drop any hashes or nonce as they will be ignored otherwise
a[k] = [i for i in v if not i.startswith("'nonce-") and not i.startswith("'sha-")]
class SecurityMiddleware(MiddlewareMixin): class SecurityMiddleware(MiddlewareMixin):
CSP_EXEMPT = ( CSP_EXEMPT = (