From 8b37dd2c863ffe1d517a8296f5cb859f03397fc8 Mon Sep 17 00:00:00 2001 From: Claire Date: Tue, 8 Aug 2023 15:41:38 +0200 Subject: [PATCH] Fix Content Security Policy sometimes unnecessarily allowing hCaptcha scripts (#26388) --- app/controllers/concerns/captcha_concern.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/concerns/captcha_concern.rb b/app/controllers/concerns/captcha_concern.rb index 576304d1ca..170c8f5e03 100644 --- a/app/controllers/concerns/captcha_concern.rb +++ b/app/controllers/concerns/captcha_concern.rb @@ -42,7 +42,7 @@ module CaptchaConcern end def extend_csp_for_captcha! - policy = request.content_security_policy + policy = request.content_security_policy&.clone return unless captcha_required? && policy.present? @@ -54,6 +54,8 @@ module CaptchaConcern policy.send(directive, *values) end + + request.content_security_policy = policy end def render_captcha