From c7d752fb65b64f372aeafd0452145f16be07ea98 Mon Sep 17 00:00:00 2001 From: snipe Date: Thu, 12 Nov 2020 19:50:01 -0800 Subject: [PATCH] Added S3 url into CSP --- app/Http/Middleware/SecurityHeaders.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Http/Middleware/SecurityHeaders.php b/app/Http/Middleware/SecurityHeaders.php index 5f77c21e1..4a75d6ec2 100644 --- a/app/Http/Middleware/SecurityHeaders.php +++ b/app/Http/Middleware/SecurityHeaders.php @@ -106,7 +106,7 @@ class SecurityHeaders $csp_policy[] = "connect-src 'self'"; $csp_policy[] = "object-src 'none'"; $csp_policy[] = "font-src 'self' data:"; - $csp_policy[] = "img-src 'self' data: ".config('app.url')." https://secure.gravatar.com http://gravatar.com maps.google.com maps.gstatic.com *.googleapis.com"; + $csp_policy[] = "img-src 'self' data: ".config('app.url')." ".env('PUBLIC_AWS_URL')." https://secure.gravatar.com http://gravatar.com maps.google.com maps.gstatic.com *.googleapis.com"; $csp_policy = join(';', $csp_policy); $response->headers->set('Content-Security-Policy', $csp_policy); }