From ee12eba234b93a81e666219ead19dacaf6b96bfb Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Thu, 2 Mar 2017 10:39:18 +0000 Subject: [PATCH] Don't try and modify policy if we don't have one --- config/initializers/secure_headers.rb | 40 +++++++++++++-------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index cd428d7dd..d1863fdd2 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -1,24 +1,24 @@ -policy = if defined?(CSP_REPORT_URL) - { - :default_src => %w('self'), - :child_src => %w('self'), - :connect_src => %w('self'), - :font_src => %w('none'), - :form_action => %w('self'), - :frame_ancestors => %w('self'), - :img_src => %w('self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr), - :media_src => %w('none'), - :object_src => %w('self'), - :plugin_types => %w('none'), - :script_src => %w('self'), - :style_src => %w('self' 'unsafe-inline'), - :report_uri => [CSP_REPORT_URL] - } - else - SecureHeaders::OPT_OUT - end +if defined?(CSP_REPORT_URL) + policy = { + :default_src => %w('self'), + :child_src => %w('self'), + :connect_src => %w('self'), + :font_src => %w('none'), + :form_action => %w('self'), + :frame_ancestors => %w('self'), + :img_src => %w('self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr), + :media_src => %w('none'), + :object_src => %w('self'), + :plugin_types => %w('none'), + :script_src => %w('self'), + :style_src => %w('self' 'unsafe-inline'), + :report_uri => [CSP_REPORT_URL] + } -policy[:script_src] << PIWIK["location"] if defined?(PIWIK) + policy[:script_src] << PIWIK["location"] if defined?(PIWIK) +else + policy = SecureHeaders::OPT_OUT +end SecureHeaders::Configuration.default do |config| config.csp = SecureHeaders::OPT_OUT -- 2.43.2