diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py index 89346e617..6fb3e4ca1 100644 --- a/files/helpers/sanitize.py +++ b/files/helpers/sanitize.py @@ -53,7 +53,7 @@ TLDS = ( # Original gTLDs and ccTLDs allowed_tags = ('a','audio','b','big','blockquote','br','center','code','del','details','em','g','h1','h2','h3','h4','h5','h6','hr','i','img','li','lite-youtube','marquee','ol','p','pre','rp','rt','ruby','small','span','spoiler','strike','strong','sub','summary','sup','table','tbody','td','th','thead','tr','u','ul','video') -allowed_styles = ['background-color', 'color', 'filter', 'font-weight', 'text-align', 'transform'] +allowed_styles = ['background-color', 'color', 'filter', 'font-weight', 'text-align'] def allowed_attributes(tag, name, value): diff --git a/includes/csp b/includes/csp index ef23ac01b..eb9a42918 100644 --- a/includes/csp +++ b/includes/csp @@ -1 +1 @@ -add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'; base-uri 'self'; font-src 'self'; style-src-elem 'self'; style-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline'; script-src-elem 'self' challenges.cloudflare.com; script-src-attr 'none'; script-src 'self' challenges.cloudflare.com; frame-src challenges.cloudflare.com www.youtube-nocookie.com platform.twitter.com rumble.com player.twitch.tv; connect-src 'self' videos.watchpeopledie.tv use1.fptls.com use1.fptls3.com api.fpjs.io; img-src rdrama.net i.rdrama.net watchpeopledie.tv i.watchpeopledie.tv videos.watchpeopledie.tv i.imgur.com i.imgur.io pomf2.lain.la i.giphy.com media.giphy.com media0.giphy.com media1.giphy.com media2.giphy.com media3.giphy.com media4.giphy.com media.tenor.com c.tenor.com thumbs.gfycat.com i.postimg.cc files.catbox.moe i.redd.it preview.redd.it external-preview.redd.it pbs.twimg.com i.pinimg.com kiwifarms.st uploads.kiwifarms.st upload.wikimedia.org live.staticflickr.com substackcdn.com i.kym-cdn.com i.kym-cdn.com 37.media.tumblr.com 64.media.tumblr.com 66.media.tumblr.com 78.media.tumblr.com i.ytimg.com fonts.googleapis.com raw.githubusercontent.com data:; media-src rdrama.net i.rdrama.net watchpeopledie.tv i.watchpeopledie.tv videos.watchpeopledie.tv i.imgur.com i.imgur.io pomf2.lain.la i.giphy.com media.giphy.com media0.giphy.com media1.giphy.com media2.giphy.com media3.giphy.com media4.giphy.com media.tenor.com c.tenor.com thumbs.gfycat.com i.postimg.cc files.catbox.moe i.redd.it preview.redd.it external-preview.redd.it pbs.twimg.com i.pinimg.com kiwifarms.st uploads.kiwifarms.st upload.wikimedia.org live.staticflickr.com substackcdn.com i.kym-cdn.com i.kym-cdn.com 37.media.tumblr.com 64.media.tumblr.com 66.media.tumblr.com 78.media.tumblr.com i.ytimg.com fonts.googleapis.com raw.githubusercontent.com;"; \ No newline at end of file +add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'; base-uri 'self'; font-src 'self'; style-src-elem 'self'; style-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline'; script-src-elem 'self' challenges.cloudflare.com; script-src-attr 'none'; script-src 'self' challenges.cloudflare.com; frame-src challenges.cloudflare.com www.youtube-nocookie.com platform.twitter.com rumble.com player.twitch.tv; connect-src 'self' videos.watchpeopledie.tv use1.fptls.com use1.fptls3.com api.fpjs.io; img-src localhost rdrama.net i.rdrama.net watchpeopledie.tv i.watchpeopledie.tv videos.watchpeopledie.tv i.imgur.com i.imgur.io pomf2.lain.la i.giphy.com media.giphy.com media0.giphy.com media1.giphy.com media2.giphy.com media3.giphy.com media4.giphy.com media.tenor.com c.tenor.com thumbs.gfycat.com i.postimg.cc files.catbox.moe i.redd.it preview.redd.it external-preview.redd.it pbs.twimg.com i.pinimg.com kiwifarms.st uploads.kiwifarms.st upload.wikimedia.org live.staticflickr.com substackcdn.com i.kym-cdn.com i.kym-cdn.com 37.media.tumblr.com 64.media.tumblr.com 66.media.tumblr.com 78.media.tumblr.com i.ytimg.com fonts.googleapis.com raw.githubusercontent.com data:; media-src localhost rdrama.net i.rdrama.net watchpeopledie.tv i.watchpeopledie.tv videos.watchpeopledie.tv i.imgur.com i.imgur.io pomf2.lain.la i.giphy.com media.giphy.com media0.giphy.com media1.giphy.com media2.giphy.com media3.giphy.com media4.giphy.com media.tenor.com c.tenor.com thumbs.gfycat.com i.postimg.cc files.catbox.moe i.redd.it preview.redd.it external-preview.redd.it pbs.twimg.com i.pinimg.com kiwifarms.st uploads.kiwifarms.st upload.wikimedia.org live.staticflickr.com substackcdn.com i.kym-cdn.com i.kym-cdn.com 37.media.tumblr.com 64.media.tumblr.com 66.media.tumblr.com 78.media.tumblr.com i.ytimg.com fonts.googleapis.com raw.githubusercontent.com;"; \ No newline at end of file