From 7e36727ce62318315698930d5209650d323a78a9 Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Wed, 3 Mar 2021 20:01:39 +0000 Subject: Fix frame-src CSP error on video embedding --- boot.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/boot.php b/boot.php index 4c3e4c00b..38269ddb6 100644 --- a/boot.php +++ b/boot.php @@ -2419,10 +2419,11 @@ function construct_page() { header("Strict-Transport-Security: max-age=31536000"); if(App::$config['system']['content_security_policy']) { - $cspsettings = Array ( - 'script-src' => Array ("'self'","'unsafe-inline'","'unsafe-eval'"), - 'style-src' => Array ("'self'","'unsafe-inline'") - ); + $cspsettings = [ + 'script-src' => [ "'self'", "'unsafe-inline'", "'unsafe-eval'" ], + 'style-src' => [ "'self'", "'unsafe-inline'" ], + 'frame-src' => [ "'self'" ] + ]; call_hooks('content_security_policy',$cspsettings); // Legitimate CSP directives (cxref: https://content-security-policy.com/) -- cgit v1.2.3