Fixed #14664 - allow additional urls in env for CSP

Signed-off-by: snipe <[email protected]>
snipe · May 16, 2024 · ca1555d · ca1555d
1 parent 7fdbbc8
commit ca1555d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/app/Http/Middleware/SecurityHeaders.php b/app/Http/Middleware/SecurityHeaders.php
@@ -88,13 +88,13 @@ public function handle($request, Closure $next)
  $csp_policy[] = "connect-src 'self'";
  $csp_policy[] = "object-src 'none'";
  $csp_policy[] = "font-src 'self' data:";
- $csp_policy[] = "img-src 'self' data: ".config('app.url').' '.env('PUBLIC_AWS_URL').' https://secure.gravatar.com http://gravatar.com maps.google.com maps.gstatic.com *.googleapis.com';
+ $csp_policy[] = "img-src 'self' data: ".config('app.url').' '.config('app.additional_csp_urls').' '.env('PUBLIC_AWS_URL').' https://secure.gravatar.com http://gravatar.com maps.google.com maps.gstatic.com *.googleapis.com';
 
  if (config('filesystems.disks.public.driver') == 's3') {
  $csp_policy[] = "img-src 'self' data: ".config('filesystems.disks.public.url');
  }
  $csp_policy = join(';', $csp_policy);
- 
+
  $response->headers->set('Content-Security-Policy', $csp_policy);
  }
 

diff --git a/config/app.php b/config/app.php
@@ -201,6 +201,9 @@
 
  'enable_csp' => env('ENABLE_CSP', true),
 
+ 'additional_csp_urls' => env('ADDITIONAL_CSP_URLS', ''),
+
+
 
  /*
  |--------------------------------------------------------------------------