github-mirrors/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2025-06-27 17:00:47 -04:00
Code Issues Projects Releases Packages Wiki Activity

Removed browser contect policy so that attachments would be visible. Part 2.

Browse source 
Thanks to xet7 !

Fixes #4468
This commit is contained in:
Lauri Ojansivu 2022-04-08 18:37:51 +03:00
parent f824eab198
commit 12448ab473
3 changed files with 3 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.meteor/packages
View file

@ -77,7 +77,6 @@ accounts-password@1.6.2
cfs:gridfs
rzymek:fullcalendar
momentjs:moment@2.22.2
browser-policy-framing@1.1.0
mquandalle:moment
msavin:usercache
# Keep stylus in 1.1.0, because building v2 takes extra 52 minutes.

2
.meteor/versions
View file

@ -18,8 +18,6 @@ binary-heap@1.0.11
blaze@2.5.0
blaze-tools@1.1.2
boilerplate-generator@1.7.1
browser-policy-common@1.0.11
browser-policy-framing@1.1.0
caching-compiler@1.2.2
caching-html-compiler@1.2.0
callback-hook@1.3.0

6
server/policy.js
View file

@ -15,18 +15,18 @@ Meteor.startup(() => {
if (process.env.BROWSER_POLICY_ENABLED === 'true') {
// Trusted URL that can embed Wekan in iFrame.
const trusted = process.env.TRUSTED_URL;
BrowserPolicy.framing.disallow();
////BrowserPolicy.framing.disallow();
//Allow inline scripts, otherwise there is errors in browser/inspect/console
//BrowserPolicy.content.disallowInlineScripts();
//BrowserPolicy.content.disallowEval();
//BrowserPolicy.content.allowInlineStyles();
//BrowserPolicy.content.allowFontDataUrl();
BrowserPolicy.framing.restrictToOrigin(trusted);
////BrowserPolicy.framing.restrictToOrigin(trusted);
//BrowserPolicy.content.allowScriptOrigin(trusted);
} else {
// Disable browser policy and allow all framing and including.
// Use only at internal LAN, not at Internet.
BrowserPolicy.framing.allowAll();
////BrowserPolicy.framing.allowAll();
}