feat: add csp settings

ayuki-joto · Apr 5, 2024 · 154a9c7 · 154a9c7
1 parent e4f541a
commit 154a9c7
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/Gemfile b/Gemfile
@@ -7,9 +7,9 @@ ruby RUBY_VERSION
 gem "decidim", "0.28.0"
 
 gem "decidim-decidim_awesome", git: "https://github.com/codeforjapan/decidim-module-decidim_awesome.git", branch: "develop"
-#
+
 gem "decidim-term_customizer", git: "https://github.com/codeforjapan/decidim-module-term_customizer.git", branch: "028-ja"
-#
+
 gem "decidim-navigation_maps", git: "https://github.com/codeforjapan/decidim-module-navigation_maps.git", branch: "upgrade-0.28-2024-04-03"
 # gem "decidim-polis", git: "https://github.com/codeforjapan/decidim-polis.git", branch: "update-0-27-4"
 

diff --git a/config/initializers/decidim.rb b/config/initializers/decidim.rb
@@ -392,6 +392,17 @@
   config.maximum_conversation_message_length = Rails.application.secrets.decidim[:maximum_conversation_message_length].to_i
   config.password_blacklist = Rails.application.secrets.decidim[:password_blacklist] if Rails.application.secrets.decidim[:password_blacklist].present?
   config.allow_open_redirects = Rails.application.secrets.decidim[:allow_open_redirects] if Rails.application.secrets.decidim[:allow_open_redirects].present?
+
+  config.content_security_policies_extra = {
+    "default-src" => '*',
+    "img-src" => '*',
+    "media-src" => '*',
+    "script-src" => '*',
+    "style-src" => '*',
+    "font-src" => '*',
+    "frame-src" => '*',
+    "connect-src" => '*',
+  }
 end
 
 if Decidim.module_installed? :api