pmkruyen / dearscholar

DearScholar: An open-source smartphone app for longitudinal scientific qualitative and quantitative (self-report) diary, log and survey research
GNU General Public License v3.0
10 stars 4 forks source link

Change CSP rules to fix browser platform warnings. #24

Closed kinow closed 4 years ago

kinow commented 4 years ago

Hi,

Related to issue #18;

Added 'unsafe-inline' to image-src, and data: to default-src CSP values to fix browser warnings.

The other changes were from my IDE removing extra white-spaces. Let me know if I should remove them to make reviewing easier :+1:

It may work fine on Android emulator, but at least for the browser platform it appears to raise some warnings in my browser console.

image

After the change:

image

pmkruyen commented 4 years ago

Hi Bruno,

I accept the data change, but not the script-src 'self' 'unsafe-inline' because of security considerations by the App Store (as I understood them).

Peter

PS. And also, accept the trailing whitespace corrections :)

kinow commented 4 years ago

Ah! Good to know Peter! Vonpletely forgot that it was going to the app store hahaha. Let me update the PR (on mobile, will log on soon)

kinow commented 4 years ago

I accept the data change, but not the script-src 'self' 'unsafe-inline' because of security considerations by the App Store (as I understood them).

'unsafe-inline' removed :+1:

kinow commented 4 years ago

@pmkruyen now the change should have the minimum code modification possible :) phew, sorry the noise

pmkruyen commented 4 years ago

the minimum code modification possible :) phew, sorry the noise

Hehehe. It helps me to get a better understanding of how all the stuff works on GitHub :)