Improve captions UX (at least I've tried)

[github/Chocobozzz/PeerTube.git] / server.ts

diff --git a/server.ts b/server.ts
index 7dffb65761573a919c7ee7dfd99ac1dabc4d3e5f..1bfec724bf116d7f66ead98f583fd3b8a08f6998 100644 (file)
--- a/server.ts
+++ b/server.ts
@@ -27,7 +27,7 @@ import { checkMissedConfig, checkFFmpeg, checkConfig, checkActivityPubUrls } fro
 
 // Do not use barrels because we don't want to load all modules here (we need to initialize database first)
 import { logger } from './server/helpers/logger'
-import { API_VERSION, CONFIG, STATIC_PATHS, CACHE } from './server/initializers/constants'
+import { API_VERSION, CONFIG, STATIC_PATHS, CACHE, REMOTE_SCHEME } from './server/initializers/constants'
 
 const missed = checkMissedConfig()
 if (missed.length !== 0) {
@@ -49,7 +49,7 @@ if (errorMessage !== null) {
 // Trust our proxy (IP forwarding...)
 app.set('trust proxy', CONFIG.TRUST_PROXY)
 
-// Security middlewares
+// Security middleware
 app.use(helmet({
   frameguard: {
     action: 'deny' // we only allow it for /videos/embed, see server/controllers/client.ts
@@ -59,13 +59,14 @@ app.use(helmet({
   },
   contentSecurityPolicy: {
     directives: {
-      fontSrc: ["'self'"],
+      defaultSrc: ['*', 'data:', REMOTE_SCHEME.WS + ':', REMOTE_SCHEME.HTTP + ':'],
+      fontSrc: ["'self'", 'data:'],
       frameSrc: ["'none'"],
-      mediaSrc: ['*', 'https:'],
+      mediaSrc: ['*', REMOTE_SCHEME.HTTP + ':'],
       objectSrc: ["'none'"],
-      scriptSrc: ["'self'"],
-      styleSrc: ["'self'"],
-      upgradeInsecureRequests: true
+      scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+      upgradeInsecureRequests: false
     },
     browserSniff: false // assumes a modern browser, but allows CDN in front
   },
@@ -73,6 +74,18 @@ app.use(helmet({
     policy: 'strict-origin-when-cross-origin'
   }
 }))
+app.use((_, res, next) => {
+  [
+    "vibrate 'none'",
+    "geolocation 'none'",
+    "camera 'none'",
+    "microphone 'none'",
+    "magnetometer 'none'",
+    "payment 'none'",
+    "accelerometer 'none'"
+  ].forEach(e => res.append('Feature-Policy', e + ';'))
+  next()
+})
 
 // ----------- Database -----------