1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
rails--rails/railties/lib/rails/application_controller.rb
Andrew White 190744cd8e Always yield a CSP policy instance
If the app has the CSP disabled globally allow a controller action
to enable the policy for that request.
2018-03-08 14:14:09 +00:00

29 lines
805 B
Ruby

# frozen_string_literal: true
class Rails::ApplicationController < ActionController::Base # :nodoc:
self.view_paths = File.expand_path("templates", __dir__)
layout "application"
before_action :disable_content_security_policy_nonce!
content_security_policy do |policy|
policy.script_src :unsafe_inline
policy.style_src :unsafe_inline
end
private
def require_local!
unless local_request?
render html: "<p>For security purposes, this information is only available to local requests.</p>".html_safe, status: :forbidden
end
end
def local_request?
Rails.application.config.consider_all_requests_local || request.local?
end
def disable_content_security_policy_nonce!
request.content_security_policy_nonce_generator = nil
end
end