Merge branch 'staging' into dist/eole/2.6.2/staging

Merge branch 'develop' into staging
Work around CSP form-action issue with CAS.
2019-09-13 16:09:32 +02:00 · 2019-09-13 16:08:44 +02:00 · 2019-09-13 16:02:48 +02:00
1 changed files with 3 additions and 0 deletions
--- a/tmpl/portal-nginx.conf
+++ b/tmpl/portal-nginx.conf
@ -4,6 +4,7 @@
 #  default           "";
 #  ~/CN=(?<CN>[^/]+) $CN;
 #}
+%set %%webDomain = %%authWebName.split('.',1)[1]

 server {
  listen 80;
@ -40,6 +41,8 @@ server {
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_split_path_info ^(.*\.psgi)(/.*)$;
    fastcgi_param PATH_INFO  $fastcgi_path_info;
+    fastcgi_hide_header Content-Security-Policy;
+    add_header Content-Security-Policy "default-src 'self'; form-action 'self' http://*.%%webDomain https://*.%%webDomain; object-src 'none'";

  }
Author	SHA1	Message	Date
Philippe Caseiro	a2f2c8f82d	Merge branch 'staging' into dist/eole/2.6.2/staging	2019-09-13 16:09:32 +02:00
Philippe Caseiro	8fbafb4c70	Merge branch 'develop' into staging	2019-09-13 16:08:44 +02:00
Philippe Caseiro	cc1da0773b	Work around CSP form-action issue with CAS. Replace header with nicer values	2019-09-13 16:02:48 +02:00