Merge branch 'master' into Develop

1 year ago · 8d0a699078
parent 7a4e6fbdfb 5b5146a793
commit 8d0a699078
1 changed files with 2 additions and 2 deletions
--- a/cps/web.py
+++ b/cps/web.py
@ -95,10 +95,10 @@ def add_security_headers(resp):
    if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive:
        csp += " *;"
    elif request.endpoint == "web.read_book":
-        csp += " style-src-elem 'self' blob: 'unsafe-inline';"
+        csp += " blob:; style-src-elem 'self' blob: 'unsafe-inline';"
    else:
        csp += ";"
-    csp += "object-src: 'none';"
+    csp += " object-src 'none';"
    resp.headers['Content-Security-Policy'] = csp
    resp.headers['X-Content-Type-Options'] = 'nosniff'
    resp.headers['X-Frame-Options'] = 'SAMEORIGIN'