From 58720aa2bdc45ec220903e0786984e803c87e8c9 Mon Sep 17 00:00:00 2001 From: Thibaut Girka Date: Sat, 4 May 2019 00:14:49 +0200 Subject: [PATCH] Fix CSP when dealing with S3 hosts --- config/initializers/content_security_policy.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 12b764a5a8..9da38598b2 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -7,9 +7,11 @@ if Rails.env.production? data_hosts = [assets_host] if ENV['S3_ENABLED'] == 'true' - attachments_host = ENV['S3_ALIAS_HOST'] || ENV['S3_CLOUDFRONT_HOST'] || ENV['S3_HOSTNAME'] || "s3-#{ENV['S3_REGION'] || 'us-east-1'}.amazonaws.com" + attachments_host = "https://#{ENV['S3_ALIAS_HOST'] || ENV['S3_CLOUDFRONT_HOST'] || ENV['S3_HOSTNAME'] || "s3-#{ENV['S3_REGION'] || 'us-east-1'}.amazonaws.com"}" + attachments_host = "https://#{Addressable::URI.parse(attachments_host).host}" elsif ENV['SWIFT_ENABLED'] == 'true' attachments_host = ENV['SWIFT_OBJECT_URL'] + attachments_host = "https://#{Addressable::URI.parse(attachments_host).host}" else attachments_host = nil end