Aditya Bansal 4898fe7ebc uploads: Change Content-Security-Policy to fix issue with pdf's. ...

Our recent addition of Content-Security-Policy to the file uploads
backend broke in-browser previews of PDFs.

The content-types change in the last commit fixed loading PDFs for
most users; but the result was ugly, because e.g. Chrome would put the
PDF previewer into a frame (so there were 2 left scrollbars).

There were two changes needed to fix this:
* Loading the style to use the plugin.  We corrected this by adding
  `style-src 'self' 'unsafe-inline';`
* Loading the plugin.  Our CSP blocked loading the PDf viewer plugin.
  To correct this, we add object-src 'self', and then limit the
  plugin-type to just the one for application/pdf.

We verified this new CSP using https://csp-evaluator.withgoogle.com/
in addition to manual testing.

2018-04-17 12:23:24 -07:00

..

apt

Fix missing newlines at ends of JSON files.

2016-04-14 10:48:52 -07:00

stdlib

Remove some some duplicate words in copy.

2017-01-23 23:15:04 -08:00

zulip

uploads: Change Content-Security-Policy to fix issue with pdf's.

2018-04-17 12:23:24 -07:00

zulip_ops

mypy: Add explicit Optional for default=None parameters in various files.

2018-03-28 12:31:51 -07:00