79 commits

Author	SHA1	Message	Date
Essem	adfa7877c3	Merge remote-tracking branch 'upstream/main'	2024-01-18 18:15:06 -06:00
Matt Jankowski	c523a9601b	Rename local webpack* var in development env CSP config (#28766)	2024-01-17 09:22:16 +00:00
Essem	978cd69dd4	Merge remote-tracking branch 'upstream/main'	2023-12-29 12:50:42 -06:00
Claire	19e14654cc	Reduce CSP configuration changes with upstream (#2536)	2023-12-27 09:54:05 +01:00
Essem	5fdd18ead1	Merge remote-tracking branch 'upstream/main'	2023-12-20 15:01:05 -06:00
Essem	cc676636f4	Merge remote-tracking branch 'upstream/main'	2023-12-19 15:24:52 -06:00
Claire	6c00d5b0c4	Fix test failure caused by glitch-soc changes	2023-12-19 21:14:39 +01:00
Essem	f628ebad02	Merge remote-tracking branch 'upstream/main'	2023-12-18 18:05:23 -06:00
Claire	46ddaffd40	Merge commit 'b87bfb8c96' into glitch-soc/merge-upstream	2023-12-18 18:34:25 +01:00
Claire	33dd5d8179	Fix Ruby lint issues	2023-12-17 23:17:55 +01:00
Claire	85662a5a57	Change img-src and media-src CSP directives to not include https: (#28025)	2023-11-30 13:47:01 +00:00
Essem	d58be1516f	Fix CSP for Tenor ... Probably want to look into properly proxying it at some point.	2023-11-29 11:07:07 -06:00
Claire	660372d130	Revert recent CSP changes (#2485) ... * Revert "Fix image and media loading when using external storage server" This reverts commit 6cfa0245ca. * Revert "Change glitch-soc's CSP config to match upstream's closer (#2474)" This reverts commit d59196e170.	2023-11-26 15:32:35 +01:00
Claire	6cfa0245ca	Fix image and media loading when using external storage server ... Fixes #2479	2023-11-21 13:45:29 +01:00
Claire	d59196e170	Change glitch-soc's CSP config to match upstream's closer (#2474)	2023-11-20 13:02:49 +01:00
Matt Jankowski	c875dfc90b	Fix Lint/UnusedBlockArgument cop (#27777)	2023-11-09 09:43:26 +00:00
Matt Jankowski	33cc3ae8fa	Fix Style/StabbyLambdaParentheses cop (#27771)	2023-11-08 12:01:18 +00:00
Matt Jankowski	eae5c7334a	Extract class from CSP configuration/initialization (#26905)	2023-10-27 16:20:40 +00:00
Claire	62620956d5	Merge commit '9a3d047f3e' into glitch-soc/merge-upstream	2023-10-25 19:59:17 +02:00
Matt Jankowski	9a3d047f3e	Run bin/rails app:update with Rails 7.1 (#27522)	2023-10-25 13:56:09 +00:00
Claire	57c0de949b	Merge commit '8b770ce811' into glitch-soc/merge-upstream ... Conflicts: - `config/initializers/content_security_policy.rb`: Upstream changed how asset host CSP directives are used, and glitch-soc has a pretty different CSP file. It may be worth reconsidering the differences between upstream and glitch-soc but for now, just port the change.	2023-10-24 19:17:20 +02:00
Claire	c3e0eb3699	Change Content-Security-Policy to be tighter on media paths (#26889)	2023-10-23 14:27:07 +02:00
Claire	ac2370778a	Merge commit 'c676bc91e9' into glitch-soc/merge-upstream ... Conflicts: - `config/environments/production.rb`: Upstream enforced a code style change and glitch-soc had a few different lines. Applied upstream's code style to glitch-soc's changes.	2023-10-08 17:21:12 +02:00
Nick Schonning	85db392464	Autofix Rubocop cops for config/ (#24145)	2023-10-03 15:24:12 +02:00
Georg Gadinger	ebd2017524	fix Content-Security-Policy when using Azure storage (#2427)	2023-09-26 20:09:56 +02:00
Claire	5ed72f668f	Merge commit 'b90383d073' into glitch-soc/merge-upstream	2023-09-15 21:39:21 +02:00
Claire	e193c848fe	Merge commit '97e4011c3c' into glitch-soc/merge-upstream ... Conflicts: - `config/initializers/content_security_policy.rb`: Upstream added some code to add the Identity Provider's sign-in endpoint to the `form-action` Content Security Policy directive but our version of the file is pretty different. Ported the change.	2023-09-15 21:25:05 +02:00
Claire	a04ae16201	Fix CSP when using ONE_CLICK_SSO_LOGIN (#26901)	2023-09-13 19:54:04 +02:00
CSDUMMI	9a70cac9de	Fix #26849 by adding the domain of the current SSO provider to the form-action CSP (#26857)	2023-09-12 13:04:51 +02:00
Christian Schmidt	286a21afdc	Support webpacker live-reloading on Docker (#26419)	2023-08-29 10:17:57 +02:00
Claire	73a3228e0f	Fix CSP tests in glitch-soc	2023-07-30 17:30:13 +02:00
Claire	993d0a9950	Merge commit '1e3b19230a' into glitch-soc/merge-upstream ... Conflicts: - `app/models/account.rb`: Upstream added new validations close to lines on which glitch-soc had modified validations to handle custom limits set through environment variables. Ported upstream changes. - `config/initializers/content_security_policy.rb`: Upstream added `AZURE_ALIAS_HOST`. Glitch-soc's version of the file is completely different. Added `AZURE_ALIAS_HOST` to our version of the file.	2023-07-30 13:15:01 +02:00
Claire	e5f1000ad1	Fix CSP headers being unintendedly wide (#26105)	2023-07-21 13:34:15 +02:00
Misty De Méo	b848ba3867	Paperclip: add support for Azure blob storage (#23607)	2023-07-19 09:02:49 +02:00
Claire	9ae60f8738	Merge commit '82e477b184' into glitch-soc/merge-upstream ... Conflicts: - `db/migrate/20180831171112_create_bookmarks.rb`: Upstream ran a lint fix on this file, but this file is different in glitch-soc because the feature was added much earlier. Ran the lint fix on our own version of the file.	2023-07-12 16:03:05 +02:00
Nick Schonning	1d557305d2	Enable Rubocop Style/FrozenStringLiteralComment (#23793)	2023-07-12 09:47:08 +02:00
Claire	e428670e61	Fix CSP headers when S3_ALIAS_HOST includes a path component (#25273)	2023-06-05 17:35:05 +02:00
Matt Jankowski	5a2aa06a51	Fix Rails/Present cop (#24688)	2023-04-30 06:47:50 +02:00
Nick Schonning	500d6f93be	Autofix Rubocop Style/IdenticalConditionalBranches (#24322)	2023-03-31 09:33:52 +02:00
Claire	7955d4b959	Add form-action CSP directive (#20781)	2022-11-17 10:55:03 +01:00
Claire	8c56441b4a	Add form-action CSP directive (#1948)	2022-11-16 16:28:48 +01:00
Claire	1901829f9a	Merge branch 'main' into glitch-soc/merge-upstream ... Conflicts: - `config/initializers/content_security_policy.rb`: Our config file is pretty different from upstream. Upstream changed CSP directive `script-src` to include `wasm-unsafe-eval` instead of `unsafe-eval`, which we did not include. Added `wasm-unsafe-eval` to `script-src` to fix execution of the OCR web worker. - `package.json`: Upstream updated a dependency (`array-includes`) textually adjacent to a glitch-soc-only dependency (`atrament`). Updated `array-includes` as upstream did.	2022-11-16 08:30:00 +01:00
Eugen Rochko	43b0b2f3f4	Fix wrong directive unsafe-wasm-eval to wasm-unsafe-eval (#20729)	2022-11-15 03:39:06 +01:00
prplecake	b46b7c3d5e	Use "unsafe-wasm-eval" instead of "unsafe-eval" in script-src CSP (#20606) ... * Add "unsafe-eval" to script-src CSP * Use 'unsafe-wasm-eval' instead of 'unsafe-eval'	2022-11-15 03:22:38 +01:00
prplecake	aafbc82d88	Add "unsafe-eval" to script-src CSP (#18817)	2022-10-26 19:23:16 +02:00
Claire	c79a03b319	Merge branch 'main' into glitch-soc/merge-upstream ... Conflicts: - `README.md`: Upstream changed their README, we have a completely different one. Kept our README.	2022-03-15 20:45:27 +01:00
Yamagishi Kazutoshi	eb9a7e3626	Fix LetterOpennerWeb CSP (#17770)	2022-03-14 19:20:40 +01:00
Claire	e2a2bc9021	Merge branch 'main' into glitch-soc/merge-upstream ... Conflicts: - `README.md`: Upstream updated copyright year, we don't mention it so kept our version. - `app/controllers/admin/dashboard_controller.rb`: Not really a conflict, upstream change (removing the spam checker) too close to glitch-soc changes. Ported upstream changes. - `app/models/form/admin_settings.rb`: Same. - `app/services/remove_status_service.rb`: Same. - `app/views/admin/settings/edit.html.haml`: Same. - `config/settings.yml`: Same. - `config/environments/production.rb`: Not a real conflict, upstream added a default HTTP header, but we have extra headers in glitch-soc. Added the header.	2021-04-20 12:17:14 +02:00
Eugen Rochko	3f2533ca8e	Fix autoloading deprecation warnings from Rails 6 (#16010)	2021-04-09 02:31:20 +02:00
Claire	f60c99a8fb	Merge branch 'main' into glitch-soc/merge-upstream	2021-03-24 10:53:50 +01:00