midou/invidious
1
0
Fork 1
mirror of https://github.com/iv-org/invidious.git synced 2025-05-31 14:11:54 +05:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1712 from tenpura-shrimp/bumpvideojs

Browse Source 
Bump videojs and fix webworker
This commit is contained in:
Perflyst
2021-01-31 12:18:40 +01:00
committed by GitHub
parent 909285ea46 4a0b10984a
commit 82da5cfd01
5 changed files with 17 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/invidious.cr
View File

@@ -217,7 +217,7 @@ before_all do |env|
extra_media_csp += " https://*.youtube.com:443"
end
# TODO: Remove style-src's 'unsafe-inline', requires to remove all inline styles (<style> [..] </style>, style=" [..] ")
env.response.headers["Content-Security-Policy"] = "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob:#{extra_media_csp}"
env.response.headers["Content-Security-Policy"] = "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob:#{extra_media_csp}; child-src blob:"
env.response.headers["Referrer-Policy"] = "same-origin"
if (Kemal.config.ssl || CONFIG.https_only) && CONFIG.hsts