pleroma

commit: 2a07411b0cb14ea26966659605d95074b02a8538
parent f50fd9278fd36e6bd3ae36bb7f5033d9fd8a84ac
Author: Henry Jameson <me@hjkos.com>
Date:   Sun,  7 May 2023 15:34:17 +0300

keep the websocket url for all modes

Diffstat:
M
lib/pleroma/web/plugs/http_security_plug.ex
4
++--

1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/pleroma/web/plugs/http_security_plug.ex b/lib/pleroma/web/plugs/http_security_plug.ex
@@ -93,7 +93,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
 
     img_src = "img-src 'self' data: blob:"
     media_src = "media-src 'self'"
-    connect_src = "connect-src 'self' blob:"
+    connect_src = ["connect-src 'self' blob: ", ?\s, websocket_url]
 
     # Strict multimedia CSP enforcement only when MediaProxy is enabled
     {img_src, media_src, connect_src} =
@@ -103,7 +103,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
         {
           [img_src, sources],
           [media_src, sources],
-          [connect_src, sources, ?\s, websocket_url]
+          [connect_src, sources]
         }
       else
         {