pleroma

commit: bb63f72c114a8d3832ff0f24576dcc10c26fd780
parent 0e1356ef9cc8c97afcc3242cfb8182a706c85276
Author: feld <feld@feld.me>
Date:   Thu, 17 Nov 2022 17:29:36 +0000

Merge branch 'flash-support-csp' into 'develop'

Reduce CSP policy to make Ruffle work on chrome

See merge request pleroma/pleroma!3389
Diffstat:
M
CHANGELOG.md
1
+
M
lib/pleroma/web/plugs/http_security_plug.ex
2
+-

2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -18,6 +18,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Updated the recommended pleroma.vcl configuration for Varnish to target Varnish 7.0+
 - Set timeout values for Oban queues. The default is infinity and some operations may not time out on their own.
 - Delete activities are federated at lowest priority
+- CSP now includes wasm-unsafe-eval
 
 ### Added
 - `activeMonth` and `activeHalfyear` fields in NodeInfo usage.users object
diff --git a/lib/pleroma/web/plugs/http_security_plug.ex b/lib/pleroma/web/plugs/http_security_plug.ex
@@ -117,7 +117,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
       if Config.get(:env) == :dev do
         "script-src 'self' 'unsafe-eval'"
       else
-        "script-src 'self'"
+        "script-src 'self' 'wasm-unsafe-eval'"
       end
 
     report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]