add suggested CSP types for media tags

8 years ago · 2a262555ed
parent cd5705b3f3
commit 2a262555ed
1 changed files with 2 additions and 2 deletions
--- a/config.example.js
+++ b/config.example.js
@ -33,9 +33,9 @@ module.exports = {
         *  it is recommended that you configure these fields to match the
         *  domain which will serve your CryptPad instance.
         */
-        "child-src 'self' *",
+        "child-src 'self' blob: *",
-        "media-src *",
+        "media-src * blob:",
        /*  this allows connections over secure or insecure websockets
            if you are deploying to production, you'll probably want to remove