diff --git a/src/strass/requirements.txt b/src/strass/requirements.txt index 5f03632fb5785e3d4d889b634464e361d48a95c9..3df95637824e706c42e358569ced70503c4fdc9c 100644 --- a/src/strass/requirements.txt +++ b/src/strass/requirements.txt @@ -28,5 +28,5 @@ tqdm gunicorn qrcode[pil] python-magic # to check mime type -django-csp +django-csp>=4.0 #END OF FILE diff --git a/src/strass/strass/settings.py b/src/strass/strass/settings.py index d6f93636d3cd2148c334d2358f19b862627c5fbb..902608858f874ea6b6fa7bd67960cda6fc6ad9f0 100644 --- a/src/strass/strass/settings.py +++ b/src/strass/strass/settings.py @@ -251,34 +251,37 @@ FILE_UPLOAD_MAX_MEMORY_SIZE = 10485760 # 10Mo ################################################################################ # DJANGO CSP, and DJANGO CSP REPORTS ################################################################################ -CSP_DEFAULT_SRC = [ - "'self'", - "*", -] -CSP_SCRIPT_SRC = [ - "'self'", - "cdn.datatables.net", - "cdnjs.cloudflare.com", - "code.jquery.com", - "plausible.pasteur.cloud", - "stackpath.bootstrapcdn.com", - "cdn.jsdelivr.net", - "www.googletagmanager.com", - "www.google-analytics.com", -] -CSP_STYLE_SRC = [ - "'self'", - "'unsafe-inline'", - '*', -] -CSP_IMG_SRC = [ - "'self'", - "*", - "data:", -] -CSP_EXCLUDE_URL_PREFIXES = ( - # "/candidate/", -) -CSP_REPORT_URI = reverse_lazy('cspmailreports:csp-report') + +CONTENT_SECURITY_POLICY = { + 'DIRECTIVES': { + 'default-src': [ + "'self'", + '*', + ], + 'script-src': [ + "'self'", + 'cdn.datatables.net', + 'cdnjs.cloudflare.com', + 'code.jquery.com', + 'plausible.pasteur.cloud', + 'stackpath.bootstrapcdn.com', + 'cdn.jsdelivr.net', + 'www.googletagmanager.com', + 'www.google-analytics.com', + ], + 'style-src': [ + "'self'", + "'unsafe-inline'", + '*', + ], + 'img-src': [ + "'self'", + "*", + "data:", + ], + 'report-uri': reverse_lazy('cspmailreports:csp-report'), + }, + 'EXCLUDE_URL_PREFIXES': (), +} ################################################################################