update csp

sarahs · sarahs · commit 73bc18717175 · 2021-01-13T14:28:11.000-05:00
diff --git a/middleware/csp.js b/middleware/csp.js
@@ -56,7 +56,7 @@ module.exports = async (req, res, next) => {
 
   // Exception for Algolia instantsearch in deprecated Enterprise docs (Node.js era)
   if (versionSatisfiesRange(requestedVersion, '<=2.19') && versionSatisfiesRange(requestedVersion, '>2.12')) {
-    csp.directives.scriptSrc.push("'unsafe-eval'", 'http://www.google-analytics.com')
+    csp.directives.scriptSrc.push("'unsafe-eval'", "'unsafe-inline'", 'http://www.google-analytics.com', 'https://ssl.google-analytics.com')
     csp.directives.connectSrc.push('https://www.google-analytics.com')
     csp.directives.imgSrc.push('http://www.google-analytics.com')
   }

Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,7 @@ module.exports = async (req, res, next) => {`
`56`	`56`
`57`	`57`	`// Exception for Algolia instantsearch in deprecated Enterprise docs (Node.js era)`
`58`	`58`	`if (versionSatisfiesRange(requestedVersion, '<=2.19') && versionSatisfiesRange(requestedVersion, '>2.12')) {`
`59`		`- csp.directives.scriptSrc.push("'unsafe-eval'", 'http://www.google-analytics.com')`
	`59`	`+ csp.directives.scriptSrc.push("'unsafe-eval'", "'unsafe-inline'", 'http://www.google-analytics.com', 'https://ssl.google-analytics.com')`
`60`	`60`	`csp.directives.connectSrc.push('https://www.google-analytics.com')`
`61`	`61`	`csp.directives.imgSrc.push('http://www.google-analytics.com')`
`62`	`62`	`}`