summary refs log tree commit diff
path: root/synapse/rest/media/v1/download_resource.py
diff options
context:
space:
mode:
authorDavid Baker <dbkr@users.noreply.github.com>2018-12-10 17:05:02 +0000
committerAmber Brown <hawkowl@atleastfornow.net>2018-12-11 04:05:02 +1100
commit89ac2a5bdb1b5ab2bf25dfaf4d50dcc9565a69c1 (patch)
tree3104aa3b8862061538148ba7e67dcc99c28d1b97 /synapse/rest/media/v1/download_resource.py
parentMerge pull request #4279 from matrix-org/hs/fix-config-cors (diff)
downloadsynapse-89ac2a5bdb1b5ab2bf25dfaf4d50dcc9565a69c1.tar.xz
Add 'sandbox' to CSP for media repo (#4284)
* Add 'sandbox' to the CSP for media repo

* Changelog
Diffstat (limited to 'synapse/rest/media/v1/download_resource.py')
-rw-r--r--synapse/rest/media/v1/download_resource.py3
1 files changed, 2 insertions, 1 deletions
diff --git a/synapse/rest/media/v1/download_resource.py b/synapse/rest/media/v1/download_resource.py
index f911b120b1..bdc5daecc1 100644
--- a/synapse/rest/media/v1/download_resource.py
+++ b/synapse/rest/media/v1/download_resource.py
@@ -48,7 +48,8 @@ class DownloadResource(Resource):
         set_cors_headers(request)
         request.setHeader(
             b"Content-Security-Policy",
-            b"default-src 'none';"
+            b"sandbox;"
+            b" default-src 'none';"
             b" script-src 'none';"
             b" plugin-types application/pdf;"
             b" style-src 'unsafe-inline';"