Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2025-09-22 01:50:48 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Removed browser contect policy so that attachments would be visible.

Browse source 
Thanks to xet7 !

Fixes #4468
This commit is contained in:
Lauri Ojansivu 2022-04-08 17:52:27 +03:00
parent 939976ce88
commit 8a39a52d5d
3 changed files with 7 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.meteor/packages
View file

@ -149,4 +149,3 @@ pascoual:pdfkit
wekan-accounts-lockout wekan-accounts-lockout
lmieulet:meteor-coverage lmieulet:meteor-coverage
meteortesting:mocha meteortesting:mocha
browser-policy-content

1
.meteor/versions
View file

@ -19,7 +19,6 @@ blaze@2.5.0
blaze-tools@1.1.2 blaze-tools@1.1.2
boilerplate-generator@1.7.1 boilerplate-generator@1.7.1
browser-policy-common@1.0.11 browser-policy-common@1.0.11
browser-policy-content@1.1.1
browser-policy-framing@1.1.0 browser-policy-framing@1.1.0
caching-compiler@1.2.2 caching-compiler@1.2.2
caching-html-compiler@1.2.0 caching-html-compiler@1.2.0

13
server/policy.js
View file

@ -1,12 +1,16 @@
import { BrowserPolicy } from 'meteor/browser-policy-common'; //import { BrowserPolicy } from 'meteor/browser-policy-common';
Meteor.startup(() => { Meteor.startup(() => {
/*
// Default allowed // Default allowed
BrowserPolicy.content.allowInlineScripts(); BrowserPolicy.content.allowInlineScripts();
BrowserPolicy.content.allowEval(); BrowserPolicy.content.allowEval();
BrowserPolicy.content.allowInlineStyles(); BrowserPolicy.content.allowInlineStyles();
BrowserPolicy.content.allowSameOriginForAll(); BrowserPolicy.content.allowOriginForAll('*');
// Allow all images from anywhere
BrowserPolicy.content.allowImageOrigin('*');
BrowserPolicy.content.allowDataUrlForAll();
*/
if (process.env.BROWSER_POLICY_ENABLED === 'true') { if (process.env.BROWSER_POLICY_ENABLED === 'true') {
// Trusted URL that can embed Wekan in iFrame. // Trusted URL that can embed Wekan in iFrame.
@ -23,11 +27,8 @@ Meteor.startup(() => {
// Disable browser policy and allow all framing and including. // Disable browser policy and allow all framing and including.
// Use only at internal LAN, not at Internet. // Use only at internal LAN, not at Internet.
BrowserPolicy.framing.allowAll(); BrowserPolicy.framing.allowAll();
//BrowserPolicy.content.allowDataUrlForAll();
} }
// Allow all images from anywhere
//BrowserPolicy.content.allowImageOrigin('*');
// If Matomo URL is set, allow it. // If Matomo URL is set, allow it.
const matomoUrl = process.env.MATOMO_ADDRESS; const matomoUrl = process.env.MATOMO_ADDRESS;