Comment Out H5P CSP

hpi-schul-cloud · Nov 7, 2023 · 1008e2c · 1008e2c
1 parent 60cd398
commit 1008e2c
Showing 1 changed file with 14 additions and 14 deletions.
diff --git a/dockerconf/nginx.conf.template b/dockerconf/nginx.conf.template
@@ -4,7 +4,7 @@ server {
 
     set $csp "default-src 'self'; base-uri 'self'; script-src 'nonce-$request_id' 'strict-dynamic' 'unsafe-inline' https:; object-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self' ${H5P_FRAME_SRC_URLS}";
 
-    set $h5pcsp "default-src 'self'; base-uri 'self'; script-src ${H5P_SCRIPT_SRC_URLS} 'unsafe-inline' https:; object-src 'none'; font-src 'self' data:; img-src 'self' ${H5P_IMG_SRC_URLS} data:; style-src 'self' 'unsafe-inline'; frame-src 'self' ${H5P_FRAME_SRC_URLS}";
+# set $h5pcsp "default-src 'self'; base-uri 'self'; script-src ${H5P_SCRIPT_SRC_URLS} 'unsafe-inline' https:; object-src 'none'; font-src 'self' data:; img-src 'self' ${H5P_IMG_SRC_URLS} data:; style-src 'self' 'unsafe-inline'; frame-src 'self' ${H5P_FRAME_SRC_URLS}";
 
     location /status {
         stub_status;
@@ -63,19 +63,19 @@ server {
         proxy_pass ${LEGACY_CLIENT_URL};
     }
 
-    location /h5p/ {
-        root   /usr/share/nginx/html/h5p;
-        index  index.html index.htm;
-        add_header Content-Security-Policy "${h5pcsp}";
-        add_header X-Content-Type-Options nosniff;
-        add_header Referrer-Policy 'same-origin';
-        add_header X-XSS-Protection '1; mode=block';
-        add_header X-Frame-Options 'SAMEORIGIN';
-        add_header Permissions-Policy 'fullscreen=(*), sync-xhr=(*), geolocation=(self), midi=(self), microphone=(self), camera=(self), magnetometer=(self), gyroscope=(self), payment=()';
-        sub_filter_once off;
-        sub_filter '**CSP_NONCE**' $request_id;
-        try_files $uri /index.html =404;
-    }
+# location /h5p/ {
+# root   /usr/share/nginx/html/h5p;
+# index  index.html index.htm;
+# add_header Content-Security-Policy "${h5pcsp}";
+# add_header X-Content-Type-Options nosniff;
+# add_header Referrer-Policy 'same-origin';
+# add_header X-XSS-Protection '1; mode=block';
+# add_header X-Frame-Options 'SAMEORIGIN';
+# add_header Permissions-Policy 'fullscreen=(*), sync-xhr=(*), geolocation=(self), midi=(self), microphone=(self), camera=(self), magnetometer=(self), gyroscope=(self), payment=()';
+# sub_filter_once off;
+# sub_filter '**CSP_NONCE**' $request_id;
+# try_files $uri /index.html =404;
+# }
 
     location / {
         root   /usr/share/nginx/html/frontend;