Merge pull request #54 from saferwall/fix-pages

csp - markdown editor - google analy
saferwall · Mar 15, 2022 · 5da2568 · 5da2568
2 parents 82d48eb + 9713ad3
commit 5da2568
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/entrypoint.sh b/entrypoint.sh
@@ -55,8 +55,8 @@ else
 
   sed -i "s/$HEAD_TAG/$GA_TAG\n$HEAD_TAG/g" $INDEX_HTML_FILE
 
-  sed -i "s~script-src~script-src https://www.google-analytics.com https://ssl.google-analytics.com
-~g" $NGINX_CONF_FILE
+  sed -i "s~script-src~script-src https://www.google-analytics.com https://ssl.google-analytics.com~g" $NGINX_CONF_FILE
+  sed -i "s~script-src-elem~script-src-elem https://www.google-analytics.com~g" $NGINX_CONF_FILE
   sed -i "s~img-src~img-src https://www.google-analytics.com~g" $NGINX_CONF_FILE
   sed -i "s~connect-src~connect-src https://www.google-analytics.com~g" $NGINX_CONF_FILE
 fi

diff --git a/nginx.conf b/nginx.conf
@@ -18,7 +18,7 @@ server {
   add_header X-Content-Type-Options nosniff;
   add_header X-XSS-Protection "1; mode=block";
   # TODO: generate nonce for vue js assets & remove unsafe-inline
-  add_header Content-Security-Policy "default-src 'self'; font-src *; script-src 'unsafe-eval' 'unsafe-inline' 'self'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; object-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' https://cdnjs.cloudflare.com/ data:; connect-src 'self' cdnjs.cloudflare.com;";
+  add_header Content-Security-Policy "default-src 'self'; font-src *; script-src 'unsafe-eval' 'unsafe-inline' 'self'; script-src-elem 'self'; style-src 'self' 'unsafe-inline' fonts.googleapis.com cdn.jsdelivr.net cdn.jsdelivr.net; object-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' https://cdnjs.cloudflare.com/ data:; connect-src 'self' cdnjs.cloudflare.com;";
 
   location / {
     try_files $uri $uri/ @rewrites;