488fba3c5f
* FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now |
||
|---|---|---|
| .. | ||
| backup_restore | ||
| content_security_policy | ||
| browser_detection_spec.rb | ||
| content_security_policy_spec.rb | ||
| db_helper_spec.rb | ||
| encodings_spec.rb | ||
| mini_sql_multisite_connection_spec.rb | ||
| upload_creator_spec.rb | ||
| upload_recovery_spec.rb | ||