Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

uploads-internal: Mark `self` as a valid source of loading media. 

Without this, browser refused to play the video. To reproduce press `open`
on an uploaded video on CZO. Chrome gives us the following error
in console:

Refused to load media from '<source>' because it violates the
following Content Security Policy directive: "default-src 'none'".
Note that 'media-src' was not explicitly set, so 'default-src' is
used as a fallback.
This commit is contained in:
Aman Agrawal 2023-10-11 05:34:50 +00:00 committed by Tim Abbott
parent c520a96354
commit f3ab45a152
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
puppet/zulip/files/nginx/zulip-include-frontend/uploads-internal.conf
View File

@ -2,7 +2,7 @@
location ~ ^/internal/s3/(?<s3_hostname>[^/]+)/(?<s3_path>.*) {
internal;
include /etc/nginx/zulip-include/headers;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
add_header Content-Security-Policy "default-src 'none'; media-src: 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
# The components of this path are originally double-URI-escaped
# (see zerver/view/upload.py). "location" matches are on
@ -46,7 +46,7 @@ location ~ ^/internal/s3/(?<s3_hostname>[^/]+)/(?<s3_path>.*) {
location /internal/local/uploads {
internal;
include /etc/nginx/zulip-include/headers;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
add_header Content-Security-Policy "default-src 'none'; media-src: 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
# Django handles setting Content-Type, Content-Disposition, and Cache-Control.