Merge branch 'main' into web-chores

freelawproject · Jul 19, 2023 · 5b07e83 · 5b07e83
2 parents 64e5b47 + 140030d
commit 5b07e83
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/cl/settings/project/security.py b/cl/settings/project/security.py
@@ -109,6 +109,11 @@
     "data:",  # @tailwindcss/forms uses data URIs for images.
     "https://*.stripe.com",
 )
+CSP_MEDIA_SRC = (
+    "'self'",
+    f"https://{AWS_S3_CUSTOM_DOMAIN}/",
+    "data:",  # Some browser extensions like this.
+)
 CSP_OBJECT_SRC = (
     "'self'",
     f"https://{AWS_S3_CUSTOM_DOMAIN}/",  # for embedded PDFs
@@ -134,7 +139,7 @@
     "'self'",
     f"https://{AWS_S3_CUSTOM_DOMAIN}/",
 )
-CSP_BASE_URI = "'none'"
+CSP_BASE_URI = "'self'"
 CSP_INCLUDE_NONCE_IN = ["script-src"]
 if not any(
     (DEVELOPMENT, TESTING)