cordova-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ste...@apache.org
Subject [3/5] cordova-app-hello-world git commit: Remove path from CSP string (since CSP ignores paths). Add CSP rationale within comment
Date Thu, 12 Mar 2015 22:58:55 GMT
Remove path from CSP string (since CSP ignores paths). Add CSP rationale within comment


Project: http://git-wip-us.apache.org/repos/asf/cordova-app-hello-world/repo
Commit: http://git-wip-us.apache.org/repos/asf/cordova-app-hello-world/commit/87da9747
Tree: http://git-wip-us.apache.org/repos/asf/cordova-app-hello-world/tree/87da9747
Diff: http://git-wip-us.apache.org/repos/asf/cordova-app-hello-world/diff/87da9747

Branch: refs/heads/3.8.x
Commit: 87da974703097d3f754bdb97968418877adcf399
Parents: a8cbbb5
Author: Andrew Grieve <agrieve@chromium.org>
Authored: Thu Mar 12 13:33:29 2015 -0400
Committer: Steve Gill <stevengill97@gmail.com>
Committed: Thu Mar 12 15:58:24 2015 -0700

----------------------------------------------------------------------
 www/index.html | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cordova-app-hello-world/blob/87da9747/www/index.html
----------------------------------------------------------------------
diff --git a/www/index.html b/www/index.html
index 0f091de..c67c617 100644
--- a/www/index.html
+++ b/www/index.html
@@ -19,7 +19,16 @@
 -->
 <html>
     <head>
-        <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap:
https://ssl.gstatic.com/accessibility/javascript/android/; style-src 'self' 'unsafe-inline';
media-src *">
+        <!--
+        Customize this policy to fit your own app's needs. For more guidance, see:
+            https://github.com/apache/cordova-plugin-whitelist/blob/master/README.md#content-security-policy
+        Some notes:
+            * gap: is required only on iOS (when using UIWebView) and is needed for JS->native
communication
+            * https://ssl.gstatic.com is required only on Android and is needed for TalkBack
to function properly
+            * To enable use of inline JS, add 'unsafe-inline' to default-src
+            * To enable use of eval(), add 'unsafe-eval' to default-src
+        -->
+        <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap:
https://ssl.gstatic.com; style-src 'self' 'unsafe-inline'; media-src *">
         <meta name="format-detection" content="telephone=no">
         <meta name="msapplication-tap-highlight" content="no">
         <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1,
minimum-scale=1, width=device-width">


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org


Mime
View raw message