fix CSP / X-Frame-Options for media embeds (#9558)

rebase/4.0.0rc2
jomo 2018-12-18 16:40:30 +01:00 committed by Eugen Rochko
parent 857e8eb312
commit 2c1a6f746f
1 changed files with 5 additions and 0 deletions

View File

@ -6,12 +6,17 @@ class MediaController < ApplicationController
before_action :set_media_attachment
before_action :verify_permitted_status!
content_security_policy only: :player do |p|
p.frame_ancestors(false)
end
def show
redirect_to @media_attachment.file.url(:original)
end
def player
@body_classes = 'player'
response.headers['X-Frame-Options'] = 'ALLOWALL'
raise ActiveRecord::RecordNotFound unless @media_attachment.video? || @media_attachment.gifv?
end