From 4b8c7c193393a69085b57a6fa97ee0aa4f018fb0 Mon Sep 17 00:00:00 2001 From: Kyle Drake Date: Sun, 7 Jan 2024 18:23:28 +0000 Subject: [PATCH] add unsafe-eval to script-src to fix replies on comments --- app.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app.rb b/app.rb index 5099557a..3d3b3ea5 100644 --- a/app.rb +++ b/app.rb @@ -92,7 +92,7 @@ after do end after do - response.headers['Content-Security-Policy'] = %{default-src 'self' data: blob: 'unsafe-inline'; script-src 'self' blob: 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com https://js.stripe.com; style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://api.stripe.com; frame-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://js.stripe.com} unless self.class.development? + response.headers['Content-Security-Policy'] = %{default-src 'self' data: blob: 'unsafe-inline'; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' https://hcaptcha.com https://*.hcaptcha.com https://js.stripe.com; style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://api.stripe.com; frame-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://js.stripe.com} unless self.class.development? end not_found do