From 2c2f649200ba5b742ba9d17ac5ba553c752b59aa Mon Sep 17 00:00:00 2001 From: Thibaut Girka Date: Sat, 4 May 2019 10:40:32 +0200 Subject: [PATCH] Fix CSP when PAPERCLIP_ROOT_URL is set to a different host --- config/initializers/content_security_policy.rb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 9da38598b2b..2fe1a33fa5d 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -15,8 +15,16 @@ if Rails.env.production? else attachments_host = nil end + data_hosts << attachments_host unless attachments_host.nil? + if ENV['PAPERCLIP_ROOT_URL'] + url = Addressable::URI.parse(assets_host) + ENV['PAPERCLIP_ROOT_URL'] + data_hosts << "https://#{url.host}" + end + + data_hosts.uniq! + Rails.application.config.content_security_policy do |p| p.base_uri :none p.default_src :none