diff options
| author | Mario <mario@mariovavti.com> | 2021-03-04 08:17:07 +0000 |
|---|---|---|
| committer | Mario <mario@mariovavti.com> | 2021-03-04 08:17:07 +0000 |
| commit | 129f8107d317df190b73ce18945c50ddc27d2969 (patch) | |
| tree | f36b37b759bb3fd033202a2b5e50a3bca15f0485 | |
| parent | 9389abdb757d5cb5b4b4322260e86c47d11ff043 (diff) | |
| parent | cb0199603908e617e10a4d8ba8ec569a59178e6b (diff) | |
| download | volse-hubzilla-129f8107d317df190b73ce18945c50ddc27d2969.tar.gz volse-hubzilla-129f8107d317df190b73ce18945c50ddc27d2969.tar.bz2 volse-hubzilla-129f8107d317df190b73ce18945c50ddc27d2969.zip | |
merge conflict
| -rw-r--r-- | boot.php | 10 | ||||
| -rw-r--r-- | include/oembed.php | 6 |
2 files changed, 9 insertions, 7 deletions
@@ -2423,10 +2423,12 @@ function construct_page() { header("Strict-Transport-Security: max-age=31536000"); if(isset(App::$config['system']['content_security_policy'])) { - $cspsettings = Array ( - 'script-src' => Array ("'self'","'unsafe-inline'","'unsafe-eval'"), - 'style-src' => Array ("'self'","'unsafe-inline'") - ); + $cspsettings = [ + 'script-src' => [ "'self'", "'unsafe-inline'", "'unsafe-eval'" ], + 'style-src' => [ "'self'", "'unsafe-inline'" ], + 'frame-src' => [ "'self'" ] + ]; + call_hooks('content_security_policy',$cspsettings); // Legitimate CSP directives (cxref: https://content-security-policy.com/) diff --git a/include/oembed.php b/include/oembed.php index 01cd8945f..9a25686fa 100644 --- a/include/oembed.php +++ b/include/oembed.php @@ -193,9 +193,9 @@ function oembed_fetch_url($embedurl){ // Youtube will happily hand us an http oembed URL even if we specify an https link; and the returned http link will fail with a 40x if you try and fetch it // This is not our bug, but good luck getting google to fix it. - if (strpos($href,'http:') === 0 && strpos($href,'youtu') !== false) { - $href = str_replace('http:','https:', $href); - } + //if (strpos($href,'http:') === 0 && strpos($href,'youtu') !== false) { + // $href = str_replace('http:','https:', $href); + //} $x = z_fetch_url($href . '&maxwidth=' . App::$videowidth); if($x['success']) |