From f9fcc16f54146b116116a996caf2f2aaf0d2062b Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Wed, 23 Aug 2017 13:36:35 +0200 Subject: [PATCH] Do not rely on CSP nonce support (breaks safari) --- src/pretix/base/middleware.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pretix/base/middleware.py b/src/pretix/base/middleware.py index d8c0c82e70..2724a0c296 100644 --- a/src/pretix/base/middleware.py +++ b/src/pretix/base/middleware.py @@ -183,7 +183,7 @@ class SecurityMiddleware(MiddlewareMixin): # frame-src is deprecated but kept for compatibility with CSP 1.0 browsers, e.g. Safari 9 'frame-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'], 'child-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'], - 'style-src': ["{static}", "'nonce-{nonce}'"], + 'style-src': ["{static}", "{media}", "'nonce-{nonce}'"], 'connect-src': ["{dynamic}", "https://checkout.stripe.com"], 'img-src': ["{static}", "{media}", "data:", "https://*.stripe.com"], # form-action is not only used to match on form actions, but also on URLs