darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-19 05:59:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use named arguments for clearer string formatting

Browse Source 
Helps when the string is long.

Also helps disambiguate between the CDN domain used for the logos and
those for CSS/JS.
This commit is contained in:
Chris Hill-Scott
2018-11-29 11:41:13 +00:00
parent fe6610c221
commit bc6b9c7af7
7 changed files with 20 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
app/__init__.py
View File

@@ -70,7 +70,7 @@ from app.notify_client.complaint_api_client import complaint_api_client
from app.notify_client.platform_stats_api_client import platform_stats_api_client
from app.notify_client.template_folder_api_client import template_folder_api_client
from app.commands import setup_commands
from app.utils import get_cdn_domain, id_safe
from app.utils import get_logo_cdn_domain, id_safe
login_manager = LoginManager()
csrf = CSRFProtect()
@@ -501,18 +501,15 @@ def useful_headers_after_request(response):
response.headers.add('X-Content-Type-Options', 'nosniff')
response.headers.add('X-XSS-Protection', '1; mode=block')
response.headers.add('Content-Security-Policy', (
"default-src 'self' {} 'unsafe-inline';"
"script-src 'self' {} *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"default-src 'self' {asset_domain} 'unsafe-inline';"
"script-src 'self' {asset_domain} *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com;"
"object-src 'self';"
"font-src 'self' {} data:;"
"img-src 'self' {} *.google-analytics.com *.notifications.service.gov.uk {} data:;"
"font-src 'self' {asset_domain} data:;"
"img-src 'self' {asset_domain} *.google-analytics.com *.notifications.service.gov.uk {logo_domain} data:;"
"frame-src 'self' www.youtube.com;".format(
configs[notify_environment].ASSET_DOMAIN,
configs[notify_environment].ASSET_DOMAIN,
configs[notify_environment].ASSET_DOMAIN,
configs[notify_environment].ASSET_DOMAIN,
get_cdn_domain(),
asset_domain=configs[notify_environment].ASSET_DOMAIN,
logo_domain=get_logo_cdn_domain(),
)
))
if 'Cache-Control' in response.headers: