Initial CSP header idea - enable tipping site-wide

This commit is contained in:
Kyle Drake 2017-02-11 15:38:03 -08:00
parent dc38851163
commit 036a45630e
2 changed files with 5 additions and 3 deletions

4
app.rb
View file

@ -77,6 +77,10 @@ before do
end
end
#after do
#response.headers['Content-Security-Policy'] = %{block-all-mixed-content; default-src 'self'; connect-src 'self' https://api.stripe.com; frame-src https://www.google.com/recaptcha/ https://js.stripe.com; script-src 'self' 'unsafe-inline' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://js.stripe.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: }
#end
not_found do
api_not_found if @api
redirect_to_internet_archive_for_geocities_sites

View file

@ -27,9 +27,7 @@
<!-- <li><a href="#domain" data-toggle="tab">Domain Name</a></li> -->
<li><a href="#custom_domain" data-toggle="tab">Custom Domain</a></li>
<li><a href="#username" data-toggle="tab">Change Site (User) Name</a></li>
<% if current_site.supporter? %>
<li><a href="#tipping" data-toggle="tab">Tipping</a></li>
<% end %>
<li><a href="#tipping" data-toggle="tab">Tipping</a></li>
<% if @site.admin_nsfw != true %>
<li><a href="#nsfw" data-toggle="tab">18+</a></li>