Kelv b751742573 FIX: invalid CSP directive sources should allow site to boot with valid CSP directives (#31256) ... [Security patch](5558e72f22) (for this [CVE](https://nvd.nist.gov/vuln/detail/CVE-2024-54133)) from rails actionpack was backported from [Rails 8.0.0.1](https://github.com/rails/rails/blob/v8.0.1/actionpack/CHANGELOG.md#rails-8001-december-10-2024) to previous stable versions including `7-1-stable` / `7-2-stable`. Any previous version of Discourse upgrading to v3.4.0.beta3 and above would have observed their sites crashing if they had invalid sources in their CSP directive extensions. This fix removes such invalid sources during our build of the CSP, and logs these at a warning level so devs are able to find out why their CSP sources were filtered out of the extendable directives.		2025-02-10 20:38:36 +08:00
..
builder.rb	FIX: invalid CSP directive sources should allow site to boot with valid CSP directives (#31256)	2025-02-10 20:38:36 +08:00
default.rb
extension.rb
middleware.rb	FEATURE: Add experimental option for strict-dynamic CSP (#25664)	2024-02-16 11:16:54 +00:00