You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@openmeetings.apache.org by Peter Dähn <da...@vcrp.de> on 2020/05/22 14:39:51 UTC
changes in csp config doesn't seem to change csp header
Hi together,
after latest update of OM to Revision aa09332 I get following error:
/Refused to load the image 'https://*HOST*/portrait' because it violates
the following Content Security Policy directive: "img-src 'self' 'self'
data: data:".
/
Changing in csp header config to
/default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'
'unsafe-inline' 'unsafe-eval'; img-src 'self' *HOST* data:;
X-Content-Type-Options '';
/
and restart om doesn't change this behavior.
Do I do something wrong or is it a bug?
Greetings Peter/
/
Re: changes in csp config doesn't seem to change csp header
Posted by Maxim Solodovnik <so...@gmail.com>.
for reference https://issues.apache.org/jira/browse/OPENMEETINGS-2370
On Sat, 23 May 2020 at 01:52, Peter Dähn <da...@vcrp.de> wrote:
> Hi Maxim,
>
> you were right. space delimited. Everything is fine with comma.
>
> Thanks for your help.
>
> Greetings Peter
>
> Am 22.05.20 um 17:04 schrieb Maxim Solodovnik:
> > `data:` is required for WB
> > so it can't be removed :(
> >
> > What was the stacktrace in the logs?
> > And what was the value?
> >
> > According to the code CSP values should be comma delimited
> > I guess you have them space delimited ...
> >
> > On Fri, 22 May 2020 at 22:00, Peter Dähn <da...@vcrp.de> wrote:
> >
> >> Hi Maxim,
> >>
> >> I needed to remove default value "data:" and just add the needed host.
> >>
> >> If it should be like that it is fine for me...
> >>
> >> Greetings Peter
> >>
> >> Am 22.05.20 um 16:55 schrieb Maxim Solodovnik:
> >>> What was the value?
> >>> And what in the logs?
> >>>
> >>> On Fri, 22 May 2020 at 21:54, Peter Dähn <da...@vcrp.de> wrote:
> >>>
> >>>> Hi Maxim,
> >>>>
> >>>> I missed this change... But if I try to change header.csp.image
> >>>>
> >>>> this ends up like this...
> >>>>
> >>>>
> >>>>
> >>>> Greetings Peter
> >>>>
> >>>> Am 22.05.20 um 16:43 schrieb Maxim Solodovnik:
> >>>>
> >>>> yep
> >>>> this huge config param was splitted
> >>>> please check herehttps://
> >>
> builds.apache.org/view/M-R/view/OpenMeetings/job/openmeetings/site/openmeetings-server/GeneralConfiguration.html
> >>>> On Fri, 22 May 2020 at 21:40, Peter Dähn <da...@vcrp.de> <
> daehn@vcrp.de>
> >> wrote:
> >>>>
> >>>> Hi together,
> >>>>
> >>>> after latest update of OM to Revision aa09332 I get following error:
> >>>>
> >>>>
> >>>> *Refused to load the image 'https://HOST/portrait' because it
> violates
> >> the
> >>>> following Content Security Policy directive: "img-src 'self' 'self'
> >> data:
> >>>> data:". *
> >>>> Changing in csp header config to
> >>>>
> >>>>
> >>>> *default-src 'self'; style-src 'self' 'unsafe-inline'; script-src
> 'self'
> >>>> 'unsafe-inline' 'unsafe-eval'; img-src 'self' HOST data:;
> >>>> X-Content-Type-Options ''; *
> >>>> and restart om doesn't change this behavior.
> >>>>
> >>>> Do I do something wrong or is it a bug?
> >>>>
> >>>> Greetings Peter
> >>>>
> >>>>
> >>>>
> >>>>
> >>
>
>
--
Best regards,
Maxim
Re: changes in csp config doesn't seem to change csp header
Posted by Peter Dähn <da...@vcrp.de>.
Hi Maxim,
you were right. space delimited. Everything is fine with comma.
Thanks for your help.
Greetings Peter
Am 22.05.20 um 17:04 schrieb Maxim Solodovnik:
> `data:` is required for WB
> so it can't be removed :(
>
> What was the stacktrace in the logs?
> And what was the value?
>
> According to the code CSP values should be comma delimited
> I guess you have them space delimited ...
>
> On Fri, 22 May 2020 at 22:00, Peter Dähn <da...@vcrp.de> wrote:
>
>> Hi Maxim,
>>
>> I needed to remove default value "data:" and just add the needed host.
>>
>> If it should be like that it is fine for me...
>>
>> Greetings Peter
>>
>> Am 22.05.20 um 16:55 schrieb Maxim Solodovnik:
>>> What was the value?
>>> And what in the logs?
>>>
>>> On Fri, 22 May 2020 at 21:54, Peter Dähn <da...@vcrp.de> wrote:
>>>
>>>> Hi Maxim,
>>>>
>>>> I missed this change... But if I try to change header.csp.image
>>>>
>>>> this ends up like this...
>>>>
>>>>
>>>>
>>>> Greetings Peter
>>>>
>>>> Am 22.05.20 um 16:43 schrieb Maxim Solodovnik:
>>>>
>>>> yep
>>>> this huge config param was splitted
>>>> please check herehttps://
>> builds.apache.org/view/M-R/view/OpenMeetings/job/openmeetings/site/openmeetings-server/GeneralConfiguration.html
>>>> On Fri, 22 May 2020 at 21:40, Peter Dähn <da...@vcrp.de> <da...@vcrp.de>
>> wrote:
>>>>
>>>> Hi together,
>>>>
>>>> after latest update of OM to Revision aa09332 I get following error:
>>>>
>>>>
>>>> *Refused to load the image 'https://HOST/portrait' because it violates
>> the
>>>> following Content Security Policy directive: "img-src 'self' 'self'
>> data:
>>>> data:". *
>>>> Changing in csp header config to
>>>>
>>>>
>>>> *default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'
>>>> 'unsafe-inline' 'unsafe-eval'; img-src 'self' HOST data:;
>>>> X-Content-Type-Options ''; *
>>>> and restart om doesn't change this behavior.
>>>>
>>>> Do I do something wrong or is it a bug?
>>>>
>>>> Greetings Peter
>>>>
>>>>
>>>>
>>>>
>>
Re: changes in csp config doesn't seem to change csp header
Posted by Maxim Solodovnik <so...@gmail.com>.
`data:` is required for WB
so it can't be removed :(
What was the stacktrace in the logs?
And what was the value?
According to the code CSP values should be comma delimited
I guess you have them space delimited ...
On Fri, 22 May 2020 at 22:00, Peter Dähn <da...@vcrp.de> wrote:
> Hi Maxim,
>
> I needed to remove default value "data:" and just add the needed host.
>
> If it should be like that it is fine for me...
>
> Greetings Peter
>
> Am 22.05.20 um 16:55 schrieb Maxim Solodovnik:
> > What was the value?
> > And what in the logs?
> >
> > On Fri, 22 May 2020 at 21:54, Peter Dähn <da...@vcrp.de> wrote:
> >
> >> Hi Maxim,
> >>
> >> I missed this change... But if I try to change header.csp.image
> >>
> >> this ends up like this...
> >>
> >>
> >>
> >> Greetings Peter
> >>
> >> Am 22.05.20 um 16:43 schrieb Maxim Solodovnik:
> >>
> >> yep
> >> this huge config param was splitted
> >> please check herehttps://
> builds.apache.org/view/M-R/view/OpenMeetings/job/openmeetings/site/openmeetings-server/GeneralConfiguration.html
> >>
> >> On Fri, 22 May 2020 at 21:40, Peter Dähn <da...@vcrp.de> <da...@vcrp.de>
> wrote:
> >>
> >>
> >> Hi together,
> >>
> >> after latest update of OM to Revision aa09332 I get following error:
> >>
> >>
> >> *Refused to load the image 'https://HOST/portrait' because it violates
> the
> >> following Content Security Policy directive: "img-src 'self' 'self'
> data:
> >> data:". *
> >> Changing in csp header config to
> >>
> >>
> >> *default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'
> >> 'unsafe-inline' 'unsafe-eval'; img-src 'self' HOST data:;
> >> X-Content-Type-Options ''; *
> >> and restart om doesn't change this behavior.
> >>
> >> Do I do something wrong or is it a bug?
> >>
> >> Greetings Peter
> >>
> >>
> >>
> >>
>
>
--
Best regards,
Maxim
Re: changes in csp config doesn't seem to change csp header
Posted by Peter Dähn <da...@vcrp.de>.
Hi Maxim,
I needed to remove default value "data:" and just add the needed host.
If it should be like that it is fine for me...
Greetings Peter
Am 22.05.20 um 16:55 schrieb Maxim Solodovnik:
> What was the value?
> And what in the logs?
>
> On Fri, 22 May 2020 at 21:54, Peter Dähn <da...@vcrp.de> wrote:
>
>> Hi Maxim,
>>
>> I missed this change... But if I try to change header.csp.image
>>
>> this ends up like this...
>>
>>
>>
>> Greetings Peter
>>
>> Am 22.05.20 um 16:43 schrieb Maxim Solodovnik:
>>
>> yep
>> this huge config param was splitted
>> please check herehttps://builds.apache.org/view/M-R/view/OpenMeetings/job/openmeetings/site/openmeetings-server/GeneralConfiguration.html
>>
>> On Fri, 22 May 2020 at 21:40, Peter Dähn <da...@vcrp.de> <da...@vcrp.de> wrote:
>>
>>
>> Hi together,
>>
>> after latest update of OM to Revision aa09332 I get following error:
>>
>>
>> *Refused to load the image 'https://HOST/portrait' because it violates the
>> following Content Security Policy directive: "img-src 'self' 'self' data:
>> data:". *
>> Changing in csp header config to
>>
>>
>> *default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'
>> 'unsafe-inline' 'unsafe-eval'; img-src 'self' HOST data:;
>> X-Content-Type-Options ''; *
>> and restart om doesn't change this behavior.
>>
>> Do I do something wrong or is it a bug?
>>
>> Greetings Peter
>>
>>
>>
>>
Re: changes in csp config doesn't seem to change csp header
Posted by Maxim Solodovnik <so...@gmail.com>.
What was the value?
And what in the logs?
On Fri, 22 May 2020 at 21:54, Peter Dähn <da...@vcrp.de> wrote:
> Hi Maxim,
>
> I missed this change... But if I try to change header.csp.image
>
> this ends up like this...
>
>
>
> Greetings Peter
>
> Am 22.05.20 um 16:43 schrieb Maxim Solodovnik:
>
> yep
> this huge config param was splitted
> please check herehttps://builds.apache.org/view/M-R/view/OpenMeetings/job/openmeetings/site/openmeetings-server/GeneralConfiguration.html
>
> On Fri, 22 May 2020 at 21:40, Peter Dähn <da...@vcrp.de> <da...@vcrp.de> wrote:
>
>
> Hi together,
>
> after latest update of OM to Revision aa09332 I get following error:
>
>
> *Refused to load the image 'https://HOST/portrait' because it violates the
> following Content Security Policy directive: "img-src 'self' 'self' data:
> data:". *
> Changing in csp header config to
>
>
> *default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'
> 'unsafe-inline' 'unsafe-eval'; img-src 'self' HOST data:;
> X-Content-Type-Options ''; *
> and restart om doesn't change this behavior.
>
> Do I do something wrong or is it a bug?
>
> Greetings Peter
>
>
>
>
--
Best regards,
Maxim
Re: changes in csp config doesn't seem to change csp header
Posted by Peter Dähn <da...@vcrp.de>.
Hi Maxim,
I missed this change... But if I try to change header.csp.image
this ends up like this...
Greetings Peter
Am 22.05.20 um 16:43 schrieb Maxim Solodovnik:
> yep
> this huge config param was splitted
> please check here
> https://builds.apache.org/view/M-R/view/OpenMeetings/job/openmeetings/site/openmeetings-server/GeneralConfiguration.html
>
> On Fri, 22 May 2020 at 21:40, Peter Dähn <da...@vcrp.de> wrote:
>
>> Hi together,
>>
>> after latest update of OM to Revision aa09332 I get following error:
>>
>>
>> *Refused to load the image 'https://HOST/portrait' because it violates the
>> following Content Security Policy directive: "img-src 'self' 'self' data:
>> data:". *
>> Changing in csp header config to
>>
>>
>> *default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'
>> 'unsafe-inline' 'unsafe-eval'; img-src 'self' HOST data:;
>> X-Content-Type-Options ''; *
>> and restart om doesn't change this behavior.
>>
>> Do I do something wrong or is it a bug?
>>
>> Greetings Peter
>>
>
Re: changes in csp config doesn't seem to change csp header
Posted by Maxim Solodovnik <so...@gmail.com>.
yep
this huge config param was splitted
please check here
https://builds.apache.org/view/M-R/view/OpenMeetings/job/openmeetings/site/openmeetings-server/GeneralConfiguration.html
On Fri, 22 May 2020 at 21:40, Peter Dähn <da...@vcrp.de> wrote:
> Hi together,
>
> after latest update of OM to Revision aa09332 I get following error:
>
>
> *Refused to load the image 'https://HOST/portrait' because it violates the
> following Content Security Policy directive: "img-src 'self' 'self' data:
> data:". *
> Changing in csp header config to
>
>
> *default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'
> 'unsafe-inline' 'unsafe-eval'; img-src 'self' HOST data:;
> X-Content-Type-Options ''; *
> and restart om doesn't change this behavior.
>
> Do I do something wrong or is it a bug?
>
> Greetings Peter
>
--
Best regards,
Maxim