DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2024-12-24 05:04:07 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix for Vue js not loading due to CSP :(

Browse source
This commit is contained in:
snipe 2020-06-25 11:00:33 -07:00
parent 35b9cf4b70
commit 339bdddc38
No known key found for this signature in database
GPG key ID: 10BFFDA3ED34B5AC
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/Http/Middleware/SecurityHeaders.php
View file

@ -87,7 +87,7 @@ class SecurityHeaders
} }
// This defaults to false to maintain backwards compatibility // This defaults to false to maintain backwards compatibility for
// people who are not running Snipe-IT over TLS (shame, shame, shame!) // people who are not running Snipe-IT over TLS (shame, shame, shame!)
// Seriously though, please run Snipe-IT over TLS. Let's Encrypt is free. // Seriously though, please run Snipe-IT over TLS. Let's Encrypt is free.
// https://letsencrypt.org // https://letsencrypt.org
@ -102,7 +102,7 @@ class SecurityHeaders
if ((config('app.debug')!='true') || (config('app.enable_csp')=='true')) { if ((config('app.debug')!='true') || (config('app.enable_csp')=='true')) {
$csp_policy[] = "default-src 'self'"; $csp_policy[] = "default-src 'self'";
$csp_policy[] = "style-src 'self' 'unsafe-inline'"; $csp_policy[] = "style-src 'self' 'unsafe-inline'";
$csp_policy[] = "script-src 'self' 'unsafe-inline'"; $csp_policy[] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'";
$csp_policy[] = "connect-src 'self'"; $csp_policy[] = "connect-src 'self'";
$csp_policy[] = "object-src 'none'"; $csp_policy[] = "object-src 'none'";
$csp_policy[] = "font-src 'self' data:"; $csp_policy[] = "font-src 'self' data:";