mirrors/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-05-27 13:34:28 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix MathJax CSP issues

Browse source
This commit is contained in:
Literallie 2017-10-18 19:37:55 +02:00
parent 080436aebb
commit 4238b9b3ef
No known key found for this signature in database
GPG key ID: 7BE463C902ED152C
5 changed files with 18 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

14
app.js
View file

@ -118,22 +118,22 @@ app.use((req, res, next) => {
// https://helmetjs.github.io/docs/csp/
if (config.csp.enable) {
var cdnDirectives = {
scriptSrc: ["https://cdnjs.cloudflare.com"],
styleSrc: ["https://cdnjs.cloudflare.com", "https://fonts.googleapis.com"],
fontSrc: ["https://cdnjs.cloudflare.com", "https://fonts.gstatic.com"]
scriptSrc: ['https://cdnjs.cloudflare.com', 'https://cdn.mathjax.org'],
styleSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.googleapis.com'],
fontSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.gstatic.com']
}
var directives = {}
for (var propertyName in config.csp.directives) {
if(config.csp.directives.hasOwnProperty(propertyName)) {
if (config.csp.directives.hasOwnProperty(propertyName)) {
var directive = config.csp.directives[propertyName]
if (config.usecdn && !!cdnDirectives[propertyName]) {
directive = directive.concat(cdnDirectives[propertyName])
}
directives[propertyName] = directive;
directives[propertyName] = directive
}
}
directives.scriptSrc.push(function (req, res) { return "'nonce-" + res.locals.nonce + "'" })
if(config.csp.upgradeInsecureRequests === 'auto') {
if (config.csp.upgradeInsecureRequests === 'auto') {
directives.upgradeInsecureRequests = config.usessl === 'true'
} else {
directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true'
@ -142,7 +142,7 @@ if (config.csp.enable) {
directives: directives
}))
} else {
logger.info('Content-Security-Policy is disabled. This may be a security risk.');
logger.info('Content-Security-Policy is disabled. This may be a security risk.')
}
i18n.configure({