Enable HMR depending on debug mode

Signed-off-by: Jonas Heinrich <[email protected]>
nextcloud · Feb 22, 2024 · 7d1ca95 · 7d1ca95
1 parent 9c00d12
commit 7d1ca95
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/lib/private/AppFramework/Middleware/Security/CSPMiddleware.php b/lib/private/AppFramework/Middleware/Security/CSPMiddleware.php
@@ -74,6 +74,17 @@ public function afterController($controller, $methodName, Response $response): R
 			$defaultPolicy->useJsNonce($this->csrfTokenManager->getToken()->getEncryptedValue());
 		}
 
+		// Loosen security presets in debug mode to enable development
+		// tools functionality
+		$debugging = \OC::$server->getConfig()->getSystemValue('debug', false);
+		if ($debugging) {
+			// Allow vue dev tool to work on Firefox.
+			$defaultPolicy->allowEvalScript(true);
+			// Unblock HMR requests.
+			$defaultPolicy->addAllowedConnectDomain('*');
+			$defaultPolicy->addAllowedScriptDomain('*');
+		}
+
 		$response->setContentSecurityPolicy($defaultPolicy);
 
 		return $response;