carpathianflorist
/
MarseyWorld
forked from MarseyWorld/MarseyWorld
1
0
Fork 0
Code Pull Requests Activity

try smth on devrama

master
Aevann 2023-09-09 02:29:50 +03:00
parent 31cf4c13f6
commit 1bb16c6e65
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
files/helpers/config/const.py
View File

@ -1141,3 +1141,8 @@ from sqlalchemy.orm import scoped_session, sessionmaker
engine = create_engine(environ.get("DATABASE_URL").strip(), connect_args={"options": "-c statement_timeout=5000 -c idle_in_transaction_session_timeout=40000"})
db_session = scoped_session(sessionmaker(bind=engine, autoflush=False))
approved_embed_hosts_for_csp = ' '.join([x.split('/')[0] for x in approved_embed_hosts])
csp = f'''add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'; base-uri 'self'; font-src 'self'; style-src-elem 'self'; style-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline'; script-src-elem 'self' challenges.cloudflare.com; script-src-attr 'none'; script-src 'self' challenges.cloudflare.com; media-src 'self' {approved_embed_hosts_for_csp}; img-src 'self' {approved_embed_hosts_for_csp} data:; frame-src challenges.cloudflare.com www.youtube-nocookie.com platform.twitter.com rumble.com player.twitch.tv; connect-src 'self' videos.watchpeopledie.tv use1.fptls.com use1.fptls3.com api.fpjs.io;";'''
with open("includes/csp", "w", encoding="utf-8") as f:
f.write(csp)

1
includes/csp 100644
View File

@ -0,0 +1 @@
add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'; base-uri 'self'; font-src 'self'; style-src-elem 'self'; style-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline'; script-src-elem 'self' challenges.cloudflare.com; script-src-attr 'none'; script-src 'self' challenges.cloudflare.com; media-src 'self' localhost rdrama.net i.rdrama.net watchpeopledie.tv i.watchpeopledie.tv videos.watchpeopledie.tv i.imgur.com i.imgur.io pomf2.lain.la i.giphy.com media.giphy.com media0.giphy.com media1.giphy.com media2.giphy.com media3.giphy.com media4.giphy.com media.tenor.com c.tenor.com thumbs.gfycat.com i.postimg.cc files.catbox.moe i.redd.it preview.redd.it external-preview.redd.it pbs.twimg.com i.pinimg.com kiwifarms.st uploads.kiwifarms.st upload.wikimedia.org live.staticflickr.com substackcdn.com i.kym-cdn.com i.kym-cdn.com 37.media.tumblr.com 64.media.tumblr.com 66.media.tumblr.com 78.media.tumblr.com i.ytimg.com fonts.googleapis.com raw.githubusercontent.com; img-src 'self' localhost rdrama.net i.rdrama.net watchpeopledie.tv i.watchpeopledie.tv videos.watchpeopledie.tv i.imgur.com i.imgur.io pomf2.lain.la i.giphy.com media.giphy.com media0.giphy.com media1.giphy.com media2.giphy.com media3.giphy.com media4.giphy.com media.tenor.com c.tenor.com thumbs.gfycat.com i.postimg.cc files.catbox.moe i.redd.it preview.redd.it external-preview.redd.it pbs.twimg.com i.pinimg.com kiwifarms.st uploads.kiwifarms.st upload.wikimedia.org live.staticflickr.com substackcdn.com i.kym-cdn.com i.kym-cdn.com 37.media.tumblr.com 64.media.tumblr.com 66.media.tumblr.com 78.media.tumblr.com i.ytimg.com fonts.googleapis.com raw.githubusercontent.com data:; frame-src challenges.cloudflare.com www.youtube-nocookie.com platform.twitter.com rumble.com player.twitch.tv; connect-src 'self' videos.watchpeopledie.tv use1.fptls.com use1.fptls3.com api.fpjs.io;";

2
includes/headers
View File

@ -2,5 +2,5 @@ add_header Referrer-Policy "same-origin";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Frame-Options "deny";
add_header X-Content-Type-Options "nosniff";
add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'; base-uri 'self'; font-src 'self'; style-src-elem 'self'; style-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline'; script-src-elem 'self' challenges.cloudflare.com; script-src-attr 'none'; script-src 'self' challenges.cloudflare.com; media-src 'self' https:; img-src 'self' https: data:; frame-src challenges.cloudflare.com www.youtube-nocookie.com platform.twitter.com rumble.com player.twitch.tv; connect-src 'self' videos.watchpeopledie.tv use1.fptls.com use1.fptls3.com api.fpjs.io;";
add_header Cross-Origin-Opener-Policy "same-origin";
include includes/csp;