kotovalexarian-likes-gitlab
/
gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Revert "Merge branch 'remove-csp-sentry-reporting' into 'master' 

This reverts commit 79b02e40e5, reversing
changes made to f2cd21e894.
This commit is contained in:
Robert Speicher 2016-07-20 19:04:03 -06:00
parent b5ef5cc6ac
commit 76e78fca97
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
config/initializers/secure_headers.rb
View File

@ -4,7 +4,14 @@
require 'gitlab/current_settings'
include Gitlab::CurrentSettings
CSP_REPORT_URI = ''
# If Sentry is enabled and the Rails app is running in production mode,
# this will construct the Report URI for Sentry.
if Rails.env.production? && current_application_settings.sentry_enabled
uri = URI.parse(current_application_settings.sentry_dsn)
CSP_REPORT_URI = "#{uri.scheme}://#{uri.host}/api#{uri.path}/csp-report/?sentry_key=#{uri.user}"
else
CSP_REPORT_URI = ''
end
# Content Security Policy Headers
# For more information on CSP see:
@ -64,7 +71,10 @@ SecureHeaders::Configuration.default do |config|
upgrade_insecure_requests: true
}
config.csp[:report_uri] = %W(#{CSP_REPORT_URI})
# Reports are sent to Sentry if it's enabled.
if current_application_settings.sentry_enabled
config.csp[:report_uri] = %W(#{CSP_REPORT_URI})
end
# Allow Bootstrap Linter in development mode.
if Rails.env.development?