specter/mastodon
1
0
Fork 0
forked from fedi/mastodon
Code Pull requests Activity

fix CSP / X-Frame-Options for media embeds (#9558)

Browse source
This commit is contained in:
jomo 2018-12-18 16:40:30 +01:00 committed by Eugen Rochko
parent 857e8eb312
commit 2c1a6f746f
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/media_controller.rb
View file

@ -6,12 +6,17 @@ class MediaController < ApplicationController
before_action :set_media_attachment
before_action :verify_permitted_status!
content_security_policy only: :player do |p|
p.frame_ancestors(false)
end
def show
redirect_to @media_attachment.file.url(:original)
end
def player
@body_classes = 'player'
response.headers['X-Frame-Options'] = 'ALLOWALL'
raise ActiveRecord::RecordNotFound unless @media_attachment.video? || @media_attachment.gifv?
end