once-campfire/app/controllers/application_controller.rb at c8f74a0b0e1e93146c4d7c1d6ac80c9079682216 - once-campfire - Vectorsigma Gitea

public/once-campfire

0 Fork 0

mirror of https://github.com/basecamp/once-campfire.git synced 2026-10-27 07:56:48 +09:00

Files

T

Jeremy Daer 562888251e Enforce a script policy that allows the importmap by hash

script-src 'self', object-src 'none' and base-uri 'self', enforced. The
two inline scripts the importmap helper emits are allowed by their
SHA-256, and the origins its URLs point to (a configured asset host, in
any form Rails accepts) are allowed by name. There is no per-request
nonce, so cached pages stay valid.

DISABLE_CONTENT_SECURITY_POLICY=true leaves the policy off, for an
install whose proxy or customization injects scripts.

2026-10-15 19:01:12 -07:00

5 lines

300 B

Ruby

Raw Blame History

 class ApplicationController < ActionController::Base
   include AllowBrowser, Authentication, Authorization, BlockBannedRequests, SetCurrentRequest, SetPlatform, TrackedRoomVisit, VersionHeaders, CachedResponses, InlineScriptHashes
   include Turbo::Streams::Broadcasts, Turbo::Streams::StreamName
 end