nightpool
commented
6 years ago Changing files at the Rails app level isn't ideal — now I'll have to remember to save that change and discard it temporarily upon future upgrades, then reapply.
Or you could just commit the change, and then git will happily take care of merging every time you want to upgrade, helpfully informing you of upstream changes to the file. People use version control systems for a reason.
I do agree that this presents a little bit of a conflict with the custom css section though. We could mitigate this by using strict-dynamic, or maybe by preprocessing a list of trusted hosts from the custom CSS style when it's saved (but this would miss transitive dependencies and so wouldn't solve your font-source issue)
Gargron
ggtea
ClearlyClaire
jokeyrhyme
raphaeleidus
decentral1se
offbyone
Justinzobel
Pitch
After the recent CSP header updates, the Google font I pulled in to customize my instance stopped working. I had this snippet of code in the "Custom CSS" field under the admin's "Site Settings":
I had to manually edit
config/initializers/content_security_policy.rband add the Google domain to the style_src directive and another domain for font_src.It would be great if I could simply edit a configuration file or change something in the site admin to facilitate this instead.
Motivation
Changing files at the Rails app level isn't ideal — now I'll have to remember to save that change and discard it temporarily upon future upgrades, then reapply.
Thanks for your consideration! (P.S. I'm a Rails developer myself, so if you could recommend a simple course of action for this sort of thing, I'd be happy to submit a PR.)