summaryrefslogtreecommitdiffstats
path: root/Bugzilla
diff options
context:
space:
mode:
authorDylan William Hardison <dylan@hardison.net>2017-01-26 18:54:38 +0100
committerDylan William Hardison <dylan@hardison.net>2017-01-26 18:54:38 +0100
commite3209457f2d4a6a134d73d0f0e5069ccfc8f88d0 (patch)
treed337d7b23ebe2faeda8168faccbe6fc33b7a2aa3 /Bugzilla
parentc768148f9facf779d572145236453e50e99bee1d (diff)
downloadbugzilla-e3209457f2d4a6a134d73d0f0e5069ccfc8f88d0.tar.gz
bugzilla-e3209457f2d4a6a134d73d0f0e5069ccfc8f88d0.tar.xz
Bug 1334158 - Lightbox images CSP error on bug modal
Diffstat (limited to 'Bugzilla')
-rw-r--r--Bugzilla/CGI.pm11
1 files changed, 10 insertions, 1 deletions
diff --git a/Bugzilla/CGI.pm b/Bugzilla/CGI.pm
index 91dec7e72..556d91441 100644
--- a/Bugzilla/CGI.pm
+++ b/Bugzilla/CGI.pm
@@ -52,9 +52,11 @@ use constant DEFAULT_CSP => (
# normally the policy would just live in one .cgi file.
# Additionally, correct_urlbase() cannot be called at compile time, so this can't be a constant.
sub SHOW_BUG_MODAL_CSP {
- return (
+ my ($bug_id) = @_;
+ my %policy = (
script_src => ['self', 'nonce', 'unsafe-inline', 'unsafe-eval' ],
object_src => [correct_urlbase() . "extensions/BugModal/web/ZeroClipboard/ZeroClipboard.swf"],
+ img_src => [ 'self', 'https://secure.gravatar.com' ],
connect_src => [
'self',
# This is from extensions/OrangeFactor/web/js/orange_factor.js
@@ -66,6 +68,13 @@ sub SHOW_BUG_MODAL_CSP {
'https://ashughes1.github.io/bugzilla-socorro-lens/chart.htm'
],
);
+ if (use_attachbase() && $bug_id) {
+ my $attach_base = Bugzilla->params->{'attachment_base'};
+ $attach_base =~ s/\%bugid\%/$bug_id/g;
+ push @{ $policy{img_src} }, $attach_base;
+ }
+
+ return %policy;
}
sub _init_bz_cgi_globals {