On Wed, Aug 28, 2019 at 01:08:01PM +0200, Julen Landa Alustiza wrote:

Good morning all!

Due to pagure's new default content security policy src.fp.o users are getting a csp-error since the ui is trying to fetch a js file from apps.fp.o and the policy denies it.

We need a configuration change on src.fp.o to modify the csp policy on src{.stg}.fp.o instances to allow clients to fetch js files from apps.fp.o

I opened an issue on the tracker[0], but since we are on freeze now here goes the same patch for a FBR.

Regards,

[0]: https://pagure.io/fedora-infrastructure/issue/8121

Julen Landa Alustiza

From 2fb07c8164aa48330449b7b7ff917155d50210ea Mon Sep 17 00:00:00 2001 From: Julen Landa Alustiza jlanda@fedoraproject.org Date: Wed, 21 Aug 2019 16:59:26 +0200 Subject: [PATCH] dist-git: Custom csp policy that allows connecting to apps.fp.o

---

roles/distgit/pagure/templates/pagure.cfg | 9 +++++++++ 1 file changed, 9 insertions(+)

diff --git a/roles/distgit/pagure/templates/pagure.cfg b/roles/distgit/pagure/templates/pagure.cfg index f3dd2c466..0aa7c7764 100644 --- a/roles/distgit/pagure/templates/pagure.cfg +++ b/roles/distgit/pagure/templates/pagure.cfg @@ -296,4 +296,13 @@ PROJECT_NAME_REGEX = '^[a-zA-z0-9_][a-zA-Z0-9-_.+]*$'

HTTP_REPO_ACCESS_GITOLITE = None

+CSP_HEADERS = (

• "default-src 'self';"
• "script-src 'self' '{nonce_script}' https://apps.fedoraproject.org; "
• "style-src 'self' '{nonce_style}'; "
• "object-src 'none';"
• "base-uri 'self';"
• "img-src 'self' https:;"

+)

{% include "pagure_shared.cfg" %}

+1 for me

Happy to apply and run the playbook for it once we have another +1 :)

For the existing CSP policy: curl -I https://src.fedoraproject.org/rpms/fedocal

Thanks Julen, Pierre