mirror of
https://github.com/zulip/zulip.git
synced 2025-10-24 08:33:43 +00:00
d360833d7f
The overall goal of this change is to fix an issue where on Ubuntu Trusty, we were accidentally overriding the configuration to serve uploads from disk with the regular expressions for adding access control headers. However, while investigating this, it became clear that we could considerably simplify the mental energy required to understand this system by making the uploads-route file be unconditionally available and included from `zulip-include/app` (which means the zulip_ops code can share behavior here). We also move the Access-Control-Allow-* headers to a separate include file, to avoid duplicating it in 5 places. Fixing this duplication discovered a potential bug in the settings used for Tornado, where DELETE was not allowed on a route that definitely expects DELETE. Fixes #11758.
13 lines
557 B
Plaintext
13 lines
557 B
Plaintext
# This Django route not under /api is shared between mobile and web
|
|
# and thus needs API headers added, in addition to the configuration
|
|
# required to have it serve files directly.
|
|
|
|
location /user_uploads {
|
|
include /etc/nginx/zulip-include/api_headers;
|
|
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
|
|
include /etc/nginx/zulip-include/uploads.types;
|
|
alias /home/zulip/uploads/files;
|
|
}
|