X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;ds=sidebyside;f=lib%2Fpleroma%2Fweb%2Fplugs%2Fhttp_security_plug.ex;h=d7cff73436a83701ed02fbfe16b85174edea0265;hb=refs%2Fheads%2Fstable;hp=5f0b775bea9e1025b28bdbc03111308743f7c02a;hpb=18bf82d7479b0bb767a657e1b7447529f9c2884f;p=akkoma

diff --git a/lib/pleroma/web/plugs/http_security_plug.ex b/lib/pleroma/web/plugs/http_security_plug.ex
index 5f0b775be..d7cff7343 100644
--- a/lib/pleroma/web/plugs/http_security_plug.ex
+++ b/lib/pleroma/web/plugs/http_security_plug.ex
@@ -8,6 +8,8 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
 
   require Logger
 
+  @mix_env Mix.env()
+
   def init(opts), do: opts
 
   def call(conn, _options) do
@@ -106,19 +108,21 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
     connect_src =
       if Config.get([:media_proxy, :enabled]) do
         sources = build_csp_multimedia_source_list()
-        ["connect-src 'self' blob: ", static_url, ?\s, websocket_url, ?\s, sources]
+        ["connect-src 'self' ", static_url, ?\s, websocket_url, ?\s, sources]
       else
-        ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
+        ["connect-src 'self' ", static_url, ?\s, websocket_url]
       end
 
-    style_src = "style-src 'self' 'unsafe-inline'"
-    font_src = "font-src 'self' data:"
+    style_src = "style-src 'self' '#{nonce_tag}'"
+    font_src = "font-src 'self'"
+
+    script_src = "script-src 'self' '#{nonce_tag}' "
 
     script_src =
-      if Config.get(:env) == :dev do
-        "script-src 'self' 'unsafe-eval' '#{nonce_tag}'"
+      if @mix_env == :dev do
+        "script-src 'self' 'unsafe-eval' 'unsafe-inline'"
       else
-        "script-src 'self' '#{nonce_tag}'"
+        script_src
       end
 
     report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]