hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'issue/3126' into 'develop'

Browse source 
MediaProxyController: Apply CSP sandbox

See merge request pleroma/pleroma!3890
This commit is contained in:
Haelwenn 2023-05-26 17:12:18 +00:00 • committed by Haelwenn (lanodan) Monnier
commit b36263e5ff
3 changed files with 24 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/pleroma/web/media_proxy/media_proxy_controller.ex
View file

@ -12,6 +12,8 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do
alias Pleroma.Web.MediaProxy
alias Plug.Conn
plug(:sandbox)
def remote(conn, %{"sig" => sig64, "url" => url64}) do
with {_, true} <- {:enabled, MediaProxy.enabled?()},
{:ok, url} <- MediaProxy.decode_url(sig64, url64),
@ -202,4 +204,9 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do
defp media_proxy_opts do
Config.get([:media_proxy, :proxy_opts], [])
end
defp sandbox(conn, _params) do
conn
|> merge_resp_headers([{"content-security-policy", "sandbox;"}])
end
end