Add: used django-csp to handle content security policies

tonythomas01 / gdrive-to-commons

Tool to upload pictures from Google Drive to Wikimedia Commons ⚠️ Moved to Wikimedia Gerrit, so this repo is read only.

https://gdrive-to-commons.toolforge.org/

Apache License 2.0

9 stars 10 forks source link

Add: used django-csp to handle content security policies #60

Closed abbasidaniyal closed 4 years ago

abbasidaniyal commented 4 years ago

As per the discussions in #45 and T248251 , the problem was CSP instead of CORS. Since we are using django-html only, CORS isn't a problem, but third-party scripts were causing the problems.

I have removed the <meta> tag hard coded into base.html and I have added the configurations in the settings.py file.

tonythomas01 commented 4 years ago

Lets give it a try anyway. However, I think at some point we have to properly support options()

tonythomas01 commented 4 years ago

I think most of it went through good, but if you look at: https://tools.wmflabs.org/google-drive-photos-to-commons/upload/

Screenshot 2020-04-25 at 18 26 38

abbasidaniyal commented 4 years ago

Although these are Report only, I will still fix it. Should not be a major PR

tonythomas01 commented 4 years ago

Agreed. I dont think this needs any immediate fix at this point.