Add subresource integrity for JS and CSS assets (#15096)

Fix #2744
2020-11-06 11:56:31 +01:00
parent 68d4b2b83e
commit 9b1f2a4b61
31 changed files with 79 additions and 39 deletions
--- a/app/views/layouts/embedded.html.haml
+++ b/app/views/layouts/embedded.html.haml
@@ -11,8 +11,8 @@
    - if storage_host?
      %link{ rel: 'dns-prefetch', href: storage_host }/

-    = stylesheet_pack_tag 'common', media: 'all'
-    = stylesheet_pack_tag Setting.default_settings['theme'], media: 'all'
+    = stylesheet_pack_tag 'common', media: 'all', crossorigin: 'anonymous'
+    = stylesheet_pack_tag Setting.default_settings['theme'], media: 'all', crossorigin: 'anonymous'
    = javascript_pack_tag 'common', integrity: true, crossorigin: 'anonymous'
    = javascript_pack_tag "locale_#{I18n.locale}", integrity: true, crossorigin: 'anonymous'
    = render_initial_state