Skip to content

Commit cbe49aa

Browse files
committed
Blogs: Allow content.jquery.com and static.jquery.com in blog CSP
For example: https://blog.jqueryui.com/2010/04/jquery-ui-talks-at-the-bay-area-jquery-conference/ Ref jquery/infrastructure-puppet#17
1 parent e64945a commit cbe49aa

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

plugins/jquery-filters.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,9 @@
112112
// Allow <style> in blog posts
113113
$policy[ 'style-src' ] = "'self' 'unsafe-inline' code.jquery.com";
114114
// Allow re-use of attachments between blog.jquery.com, blog.jqueryui.com, and blog.jquerymobile.com
115-
// Allow re-use of doc site resources from jqueryui.com in posts on blog.jqueryui.com
116-
$policy[ 'img-src' ] = "'self' data: secure.gravatar.com code.jquery.com jquery.com jqueryui.com jquerymobile.com blog.jquery.com blog.jqueryui.com blog.jquerymobile.com";
115+
// Allow use of doc site resources from jqueryui.com in posts on blog.jqueryui.com
116+
// Allow use of content.jquery.com (aka static.jquery.com) in blog posts, e.g. event avatars.
117+
$policy[ 'img-src' ] = "'self' data: secure.gravatar.com code.jquery.com content.jquery.com static.jquery.com jquery.com jqueryui.com jquerymobile.com blog.jquery.com blog.jqueryui.com blog.jquerymobile.com";
117118
// Allow Vimeo on blog.jquerymobile.com and other blogs
118119
$policy[ 'frame-src' ] = "'self' player.vimeo.com";
119120

0 commit comments

Comments
 (0)