Commit 78119249 authored by Sven Franck's avatar Sven Franck Committed by Sebastien Robin

erp5_web_renderjs_ui: update CSP to allow loading data from openstreetmap

parent 85c87bc6
...@@ -68,7 +68,9 @@ response.setHeader("X-Frame-Options", "SAMEORIGIN")\n ...@@ -68,7 +68,9 @@ response.setHeader("X-Frame-Options", "SAMEORIGIN")\n
response.setHeader("X-Content-Type-Options", "nosniff")\n response.setHeader("X-Content-Type-Options", "nosniff")\n
\n \n
# Only fetch code (html, js, css, image) and data from this ERP5, to prevent any data leak as the web site do not control the gadget\'s code\n # Only fetch code (html, js, css, image) and data from this ERP5, to prevent any data leak as the web site do not control the gadget\'s code\n
response.setHeader("Content-Security-Policy", "default-src \'none\'; img-src \'self\' data:; media-src \'self\'; connect-src \'self\'; script-src \'self\' \'unsafe-eval\'; style-src \'self\' \'unsafe-inline\' data:; frame-src \'self\' data:")\n # XXX: allow openstreetmap\n
# response.setHeader("Content-Security-Policy", "default-src \'none\'; img-src \'self\' data:; media-src \'self\'; connect-src \'self\'; script-src \'self\' \'unsafe-eval\'; style-src \'self\' \'unsafe-inline\' data:; frame-src \'self\' data:")\n
response.setHeader("Content-Security-Policy", "default-src \'none\'; img-src \'self\' https://a.tile.openstreetmap.org https://b.tile.openstreetmap.org https://c.tile.openstreetmap.org data:; media-src \'self\'; connect-src \'self\' https://nominatim.openstreetmap.org ; script-src \'self\' \'unsafe-eval\'; style-src \'self\' \'unsafe-inline\' data:; frame-src \'self\' data:")\n
\n \n
\n \n
response.setHeader(\'Content-Type\', \'text/html\')\n response.setHeader(\'Content-Type\', \'text/html\')\n
......
59 60
\ No newline at end of file \ No newline at end of file
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment