summary refs log tree commit diff
diff options
context:
space:
mode:
authorErik Johnston <erik@matrix.org>2016-09-05 17:35:01 +0100
committerErik Johnston <erik@matrix.org>2016-09-05 17:35:01 +0100
commitd51b8a1674974ec0d694f86e6a911f45efba643a (patch)
tree748bec14aa38ea45e254adec81e9c6f398fab368
parentAllow PDF to be rendered from media repo (diff)
downloadsynapse-d51b8a1674974ec0d694f86e6a911f45efba643a.tar.xz
Add quotes and be explicity about script-src
-rw-r--r--synapse/rest/media/v1/download_resource.py3
1 files changed, 2 insertions, 1 deletions
diff --git a/synapse/rest/media/v1/download_resource.py b/synapse/rest/media/v1/download_resource.py
index e3843c1be5..a45ee9483e 100644
--- a/synapse/rest/media/v1/download_resource.py
+++ b/synapse/rest/media/v1/download_resource.py
@@ -47,7 +47,8 @@ class DownloadResource(Resource):
     def _async_render_GET(self, request):
         request.setHeader(
             "Content-Security-Policy",
-            "default-src none;"
+            "default-src 'none';"
+            " script-src 'none';"
             " plugin-types application/pdf;"
             " style-src 'unsafe-inline';"
             " object-src 'self';"