Jeremy Daer b11ed1cb6e Make CSP embed directives configurable per install ...

Campfire is self-hosted per customer: an admin may embed or connect to
external hosts (video/embed providers, image CDNs, analytics, form or
webhook endpoints) that vary per install and are unknown at build time.
Hardcoding these directives at :self would break those integrations once
the policy is enforced.

Read per-install extras from ENV (CSP_EXTRA_SCRIPT_SRC, _STYLE_SRC,
_IMG_SRC, _CONNECT_SRC, _FRAME_SRC, _FORM_ACTION), each a comma- or
whitespace-separated host list, appended to the :self baseline. Unset by
default, so the policy stays at :self only unless an admin opts in.

2026-08-08 18:33:58 -07:00

..

channels

Scope the unread rooms stream per user

2026-08-03 14:55:19 -07:00

controllers

Scope the unread rooms stream per user

2026-08-03 14:55:19 -07:00

fixtures

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

helpers

Hello world

2025-08-21 09:31:59 +01:00

integration

Make CSP embed directives configurable per install

2026-08-08 18:33:58 -07:00

lib

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

models

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

performance

Hello world

2025-08-21 09:31:59 +01:00

system

Hello world

2025-08-21 09:31:59 +01:00

test_helpers

Hello world

2025-08-21 09:31:59 +01:00

application_system_test_case.rb

Hello world

2025-08-21 09:31:59 +01:00

test_helper.rb

Now required to be explicitly included

2025-12-01 15:23:57 +01:00