From cc444c606e6d4a3699c591db0f28e57700e63dab Mon Sep 17 00:00:00 2001 From: Ylian Saint-Hilaire Date: Wed, 31 Aug 2022 12:24:04 -0700 Subject: [PATCH] Reverted web relay content security policy (#4474) --- apprelays.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apprelays.js b/apprelays.js index 61b27a34..59b96827 100644 --- a/apprelays.js +++ b/apprelays.js @@ -715,7 +715,8 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) { } else if (blockHeaders.indexOf(i) == -1) { obj.res.set(i, header[i]); } // Set the headers if not blocked } - obj.res.set('Content-Security-Policy', "default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';"); // Set an "allow all" policy, see if the can restrict this in the future + obj.res.set('Content-Security-Policy', "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:;"); // Set an "allow all" policy, see if the can restrict this in the future + //obj.res.set('Content-Security-Policy', "default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';"); // Set an "allow all" policy, see if the can restrict this in the future obj.res.set('Cache-Control', 'no-store'); // Tell the browser not to cache the responses since since the relay port can be used for many relays }