Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://gh.wpcy.net/https://github.com/discourse/discourse.git synced 2026-05-08 23:36:42 +08:00
Code Packages Activity Actions
discourse/spec/fixtures/plugins
History
Exact
Kelv b751742573
FIX: invalid CSP directive sources should allow site to boot with valid CSP directives (#31256) 
[Security
patch](5558e72f22)
(for this [CVE](https://nvd.nist.gov/vuln/detail/CVE-2024-54133)) from
rails actionpack was backported from [Rails
8.0.0.1](https://github.com/rails/rails/blob/v8.0.1/actionpack/CHANGELOG.md#rails-8001-december-10-2024)
to previous stable versions including `7-1-stable` / `7-2-stable`.

Any previous version of Discourse upgrading to v3.4.0.beta3 and above
would have observed their sites crashing if they had invalid sources in
their CSP directive extensions.

This fix removes such invalid sources during our build of the CSP, and
logs these at a warning level so devs are able to find out why their CSP
sources were filtered out of the extendable directives.
2025-02-10 20:38:36 +08:00
..
color_definition
csp_extension FIX: invalid CSP directive sources should allow site to boot with valid CSP directives (#31256) 2025-02-10 20:38:36 +08:00
custom_locales DEV: Update MomentJS and highlightJS 2020-11-11 12:34:26 +11:00
my_plugin DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
scss_plugin FEATURE: Serve RTL versions of admin and plugins CSS bundles for RTL locales (#21876) 2023-06-01 05:27:11 +03:00