diff options
| -rw-r--r-- | server/middlewares/csp.ts | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/server/middlewares/csp.ts b/server/middlewares/csp.ts index d484b3021..d11d70790 100644 --- a/server/middlewares/csp.ts +++ b/server/middlewares/csp.ts | |||
| @@ -7,8 +7,8 @@ const baseDirectives = Object.assign({}, | |||
| 7 | connectSrc: ['*', 'data:'], | 7 | connectSrc: ['*', 'data:'], |
| 8 | mediaSrc: ["'self'", 'https:', 'blob:'], | 8 | mediaSrc: ["'self'", 'https:', 'blob:'], |
| 9 | fontSrc: ["'self'", 'data:'], | 9 | fontSrc: ["'self'", 'data:'], |
| 10 | imgSrc: ["'self'", 'data:'], | 10 | imgSrc: ["'self'", 'data:', 'blob:'], |
| 11 | scriptSrc: ["'self' 'unsafe-inline' 'unsafe-eval'"], | 11 | scriptSrc: ["'self' 'unsafe-inline' 'unsafe-eval'", 'blob:'], |
| 12 | styleSrc: ["'self' 'unsafe-inline'"], | 12 | styleSrc: ["'self' 'unsafe-inline'"], |
| 13 | objectSrc: ["'none'"], // only define to allow plugins, else let defaultSrc 'none' block it | 13 | objectSrc: ["'none'"], // only define to allow plugins, else let defaultSrc 'none' block it |
| 14 | formAction: ["'self'"], | 14 | formAction: ["'self'"], |