mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
190744cd8e
If the app has the CSP disabled globally allow a controller action to enable the policy for that request.
29 lines
805 B
Ruby
29 lines
805 B
Ruby
# frozen_string_literal: true
|
|
|
|
class Rails::ApplicationController < ActionController::Base # :nodoc:
|
|
self.view_paths = File.expand_path("templates", __dir__)
|
|
layout "application"
|
|
|
|
before_action :disable_content_security_policy_nonce!
|
|
|
|
content_security_policy do |policy|
|
|
policy.script_src :unsafe_inline
|
|
policy.style_src :unsafe_inline
|
|
end
|
|
|
|
private
|
|
|
|
def require_local!
|
|
unless local_request?
|
|
render html: "<p>For security purposes, this information is only available to local requests.</p>".html_safe, status: :forbidden
|
|
end
|
|
end
|
|
|
|
def local_request?
|
|
Rails.application.config.consider_all_requests_local || request.local?
|
|
end
|
|
|
|
def disable_content_security_policy_nonce!
|
|
request.content_security_policy_nonce_generator = nil
|
|
end
|
|
end
|