From a23aaa131d757f79729ee3ef4e5f7ec2a4d061cc Mon Sep 17 00:00:00 2001 From: Severiano Badajoz Date: Thu, 13 Aug 2020 11:17:13 -0700 Subject: [PATCH] regenerate hash and fix url (#1742) The script hash had a typo in it and was incorrectly generated. The URL in the `img-src` directive also did not need to be encased in single-quotes. Reviewers please double-check my hash generation against the inline-script here: https://github.com/chanzuckerberg/cellxgene/blob/main/client/configuration/webpack/obsoleteHTMLTemplate.html --- server/eb/app.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/eb/app.py b/server/eb/app.py index 55f68511..9db9b07f 100644 --- a/server/eb/app.py +++ b/server/eb/app.py @@ -98,14 +98,14 @@ class WSGIServer(Server): server_config = app_config.server_config # This hash should be in sync with the script within # `client/configuration/webpack/obsoleteHTMLTemplate.html` - obsolete_browser_script_hash = ["'SHA25-0028D52E332C015C3ED9929926F4000BB4020B8CB85C1F5769D6AA3BA711F58E'"] + obsolete_browser_script_hash = ["'sha256-wl4OlniJEAFM1/VNFG/LBDQyPRkO7P/5kfQWf3+fPWE='"] csp = { "default-src": ["'self'"], "connect-src": ["'self'"], "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + obsolete_browser_script_hash + script_hashes, "style-src": ["'self'", "'unsafe-inline'"], - "img-src": ["'self'", "'https://cellxgene.cziscience.com'", "data:"], + "img-src": ["'self'", "https://cellxgene.cziscience.com", "data:"], "object-src": ["'none'"], "base-uri": ["'none'"], "frame-ancestors": ["'none'"],