PonyMirrors/philomena
1
0
Fork 0
mirror of https://github.com/philomena-dev/philomena.git synced 2025-03-06 11:01:27 +01:00
Code Issues Projects Releases Packages Wiki Activity

Relax SCP in dev env to allow for private IPs

Browse source
This commit is contained in:
MareStare 2025-03-04 02:34:55 +00:00
parent 64f954e686
commit e58adaf64a
1 changed files with 26 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
lib/philomena_web/plugs/content_security_policy_plug.ex
View file

@ -25,8 +25,8 @@ defmodule PhilomenaWeb.ContentSecurityPolicyPlug do
csp_config = [
{:default_src, ["'self'"]},
{:script_src, [default_script_src() | script_src]},
{:connect_src, [default_connect_src()]},
{:script_src, [default_script_src(conn.host) | script_src]},
{:connect_src, [default_connect_src(conn.host)]},
{:style_src, [default_style_src() | style_src]},
{:object_src, ["'none'"]},
{:frame_ancestors, ["'none'"]},
@ -66,10 +66,31 @@ defmodule PhilomenaWeb.ContentSecurityPolicyPlug do
defp cdn_uri, do: Application.get_env(:philomena, :cdn_host) |> to_uri()
defp camo_uri, do: Application.get_env(:philomena, :camo_host) |> to_uri()
defp default_script_src, do: vite_hmr?(do: "'self' localhost:5173", else: "'self'")
# Use the "current host" in vite HMR mode for whatever the "current host" is.
# Usually it's `localhost`, but it may be some other private IP address, that
# you use to test the frontend on a mobile device connected via a local Wi-Fi.
defp default_script_src(host) do
# Workaround for a compile warning where `host` variable is unused if we
# inline the if branches into the `vite_hmr?` macro.
is_vite_hmr = vite_hmr?(do: true, else: false)
defp default_connect_src,
do: vite_hmr?(do: "'self' localhost:5173 ws://localhost:5173", else: "'self'")
if is_vite_hmr do
"'self' #{host}:5173"
else
"'self'"
end
end
defp default_connect_src(host) do
# Same workaround as in `default_script_src/1`
is_vite_hmr = vite_hmr?(do: true, else: false)
if is_vite_hmr do
"'self' #{host}:5173 ws://#{host}:5173"
else
"'self'"
end
end
defp default_style_src, do: vite_hmr?(do: "'self' 'unsafe-inline'", else: "'self'")