monorail
/
mastodon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix CSP / X-Frame-Options for media embeds (#9558)

This commit is contained in:
jomo 2018-12-18 16:40:30 +01:00 committed by Eugen Rochko
parent 857e8eb312
commit 2c1a6f746f
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/controllers/media_controller.rb
View File

@ -6,12 +6,17 @@ class MediaController < ApplicationController
before_action :set_media_attachment before_action :set_media_attachment
before_action :verify_permitted_status! before_action :verify_permitted_status!
content_security_policy only: :player do |p|
p.frame_ancestors(false)
end
def show def show
redirect_to @media_attachment.file.url(:original) redirect_to @media_attachment.file.url(:original)
end end
def player def player
@body_classes = 'player' @body_classes = 'player'
response.headers['X-Frame-Options'] = 'ALLOWALL'
raise ActiveRecord::RecordNotFound unless @media_attachment.video? || @media_attachment.gifv? raise ActiveRecord::RecordNotFound unless @media_attachment.video? || @media_attachment.gifv?
end end