CSP: Allow self as frame-src

The reveal.js speaker view uses frames to display the slides Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-06 12:11:08 +02:00
parent 1642242078
commit 46cd60c510
1 changed files with 1 additions and 1 deletions
--- a/lib/csp.js
+++ b/lib/csp.js
@@ -8,7 +8,7 @@ const defaultDirectives = {
  baseUri: ['\'self\''],
  connectSrc: ['\'self\''],
  fontSrc: ['\'self\''],
-  frameSrc: ['https://player.vimeo.com', 'https://www.slideshare.net/slideshow/embed_code/key/', 'https://www.youtube.com'],
+  frameSrc: ['\'self\'', 'https://player.vimeo.com', 'https://www.slideshare.net/slideshow/embed_code/key/', 'https://www.youtube.com'],
  imgSrc: ['*'], // we allow using arbitrary images
  scriptSrc: [
    config.serverURL + '/build/',