Override CSP setting in the embed controller to allow frames

2018-08-22 17:37:51 +02:00 · 2018-08-22 17:37:51 +02:00 · 628fca50e2
parent e7a72439f1
commit 628fca50e2
1 changed files with 4 additions and 0 deletions
--- a/app/controllers/statuses_controller.rb
+++ b/app/controllers/statuses_controller.rb
@ -19,6 +19,10 @@ class StatusesController < ApplicationController
  before_action :set_referrer_policy_header, only: [:show]
  before_action :set_cache_headers

+  content_security_policy only: :embed do |p|
+    p.frame_ancestors(false)
+  end
+
  def show
    respond_to do |format|
      format.html do