zydronium/manage.get.gov
1
0
Fork 0
mirror of https://github.com/cisagov/manage.get.gov.git synced 2025-08-05 09:21:54 +02:00
Code Issues Projects Releases Packages Wiki Activity

Allowing ANDI images

Browse source
This commit is contained in:
Rebecca Hsieh 2024-08-13 12:04:25 -07:00
parent ebbd329c98
commit 5cd5cd645a
No known key found for this signature in database
2 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/registrar/config/settings.py
View file

@ -357,9 +357,20 @@ CSP_FORM_ACTION = allowed_sources
# strict CSP by allowing scripts to run from their domain
# and inline with a nonce, as well as allowing connections back to their domain.
# Note: If needed, we can embed chart.js instead of using the CDN
CSP_SCRIPT_SRC_ELEM = ["'self'", "https://www.googletagmanager.com/", "https://cdn.jsdelivr.net/npm/chart.js"]
CSP_CONNECT_SRC = ["'self'", "https://www.google-analytics.com/"]
CSP_INCLUDE_NONCE_IN = ["script-src-elem"]
CSP_DEFAULT_SRC = [
"'self'",
]
CSP_STYLE_SRC = ["'self'", "https://www.ssa.gov", "'unsafe-inline'"]
CSP_SCRIPT_SRC_ELEM = [
"'self'",
"https://www.googletagmanager.com/",
"https://cdn.jsdelivr.net/npm/chart.js",
"https://www.ssa.gov",
"https://ajax.googleapis.com",
]
CSP_CONNECT_SRC = ["'self'", "https://www.google-analytics.com/", "https://www.ssa.gov"]
CSP_INCLUDE_NONCE_IN = ["script-src-elem", "style-src"]
CSP_IMG_SRC = ["'self'", "https://www.ssa.gov"]
# Cross-Origin Resource Sharing (CORS) configuration
# Sets clients that allow access control to manage.get.gov

2
src/registrar/registrar_middleware.py
View file

@ -168,7 +168,7 @@ class ANDIMiddleware(MiddlewareMixin):
response = self.get_response(request)
return response
def process_view(self, request, view_func, view_args, view_kwargs):
def process_template_view(self, request, view_func, view_args, view_kwargs):
response = self.get_response(request)
if "text/html" in response.get("Content-Type", ""):
andi_script = """