21 commits

Author	SHA1	Message	Date
Alex Gleason	6e0b046771	Let blob: pass CSP	2020-05-01 00:40:09 +03:00
Haelwenn (lanodan) Monnier	6da6540036	Bump copyright years of files changed after 2020-01-07 ... Done via the following command: git diff fcd5dd259a --stat --name-only | xargs sed -i '/Pleroma Authors/c# Copyright © 2017-2020 Pleroma Authors <https:\/\/pleroma.social\/>'	2020-03-02 06:08:45 +01:00
feld	36becd5573	Update http_security_plug.ex	2020-01-30 14:07:41 +00:00
Egor Kislitsyn	e07e7888d7	Fix credo warning	2020-01-29 18:53:43 +04:00
Egor Kislitsyn	2bd4d6289b	Make the warning more scarier	2020-01-29 18:43:23 +04:00
Egor Kislitsyn	6302b40791	Warn if HTTPSecurityPlug is disabled	2020-01-28 19:14:09 +04:00
rinpatch	92213fb87c	Replace Mix.env with Pleroma.Config.get(:env) ... Mix.env/0 is not availible in release environments such as distillery or elixir's built-in releases.	2019-06-06 23:59:51 +03:00
Alex S	aa11fa4864	add report uri and report to	2019-05-16 12:49:40 +07:00
feld	acb04306b6	Standardize construction of websocket URL ... This follows up on the change made in d747bd98	2019-05-03 11:45:04 +00:00
Haelwenn (lanodan) Monnier	fc37e5815f	Plugs.HTTPSecurityPlug: Add static_url to CSP's connect-src ... Closes: https://git.pleroma.social/pleroma/pleroma/merge_requests/469	2019-03-05 01:44:24 +01:00
Haelwenn (lanodan) Monnier	da4c662af3	Plugs.HTTPSecurityPlug: Add webpacker to connect-src	2019-02-12 22:12:12 +01:00
Haelwenn (lanodan) Monnier	00e8f0b07d	Plugs.HTTPSecurityPlug: Add unsafe-eval to script-src when in dev mode ... This is needed to run dev mode mastofe at the same time	2019-02-12 22:12:11 +01:00
shibayashi	ea1058929c	Use url[:scheme] instead of protocol to determine if https is enabled	2019-02-12 00:08:52 +01:00
William Pitcock	980b5288ed	update copyright years to 2019	2018-12-31 15:41:47 +00:00
William Pitcock	2791ce9a1f	add license boilerplate to pleroma core	2018-12-23 20:56:42 +00:00
Maksim Pechnikov	074fa790ba	fix compile warnings	2018-12-09 20:50:08 +03:00
Haelwenn (lanodan) Monnier	04daa0fa44	Plugs.HTTPSecurityPlug: Activate upgrade-insecure-requests only when there is https ... This fixes running mastofe with MIX_ENV=dev	2018-11-26 21:41:36 +01:00
shibayashi	591b11eafc	Add manifest-src to allow manifest.json	2018-11-26 20:48:24 +01:00
William Pitcock	c07464607d	http security: remove form-action from CSP definitions	2018-11-16 17:40:21 +00:00
William Pitcock	ee5932a504	http security: allow referrer-policy to be configured	2018-11-12 15:14:46 +00:00
William Pitcock	fe67665e19	rename CSPPlug to HTTPSecurityPlug.	2018-11-12 15:08:02 +00:00

Renamed from lib/pleroma/plugs/csp_plug.ex (Browse further)