From 6111a4d92776bfaed5393c2c5f477c1191b1c0ea Mon Sep 17 00:00:00 2001
From: "Collin M. Barrett" <collinbarrett@users.noreply.github.com>
Date: Sun, 28 Jul 2019 19:39:20 -0500
Subject: [PATCH] manifest-src self csp

---
 ops/nginx/conf.d.dev/filterlists.conf | 4 ----
 ops/nginx/conf.d/filterlists.conf     | 2 +-
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/ops/nginx/conf.d.dev/filterlists.conf b/ops/nginx/conf.d.dev/filterlists.conf
index 413d73315..ab9c4f6cc 100644
--- a/ops/nginx/conf.d.dev/filterlists.conf
+++ b/ops/nginx/conf.d.dev/filterlists.conf
@@ -1,9 +1,5 @@
 server {
   listen 80 default_server;
-
-  include svr-includes/*;
-
-  add_header Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self';" always;
   
   location ^~ /api {
     rewrite ^/api/(.*)$ /$1 break;
diff --git a/ops/nginx/conf.d/filterlists.conf b/ops/nginx/conf.d/filterlists.conf
index 019bdf6f8..d6921cdd1 100644
--- a/ops/nginx/conf.d/filterlists.conf
+++ b/ops/nginx/conf.d/filterlists.conf
@@ -7,7 +7,7 @@ server {
   ssl_certificate /etc/nginx/cert/filterlists_cert.pem;
   ssl_certificate_key /etc/nginx/cert/filterlists_key.pem;
 
-  add_header Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self';" always;
+  add_header Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self'; manifest-src 'self';" always;
 
   location ^~ /api {
     rewrite ^/api/(.*)$ /$1 break;