diff options
Diffstat (limited to 'app/controllers/jira_connect/subscriptions_controller.rb')
| -rw-r--r-- | app/controllers/jira_connect/subscriptions_controller.rb | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/app/controllers/jira_connect/subscriptions_controller.rb b/app/controllers/jira_connect/subscriptions_controller.rb index 623113f8413..9305f46c39e 100644 --- a/app/controllers/jira_connect/subscriptions_controller.rb +++ b/app/controllers/jira_connect/subscriptions_controller.rb @@ -64,10 +64,12 @@ class JiraConnect::SubscriptionsController < JiraConnect::ApplicationController private def allow_self_managed_content_security_policy + return unless Feature.enabled?(:jira_connect_oauth_self_managed) + return unless current_jira_installation.instance_url? request.content_security_policy.directives['connect-src'] ||= [] - request.content_security_policy.directives['connect-src'] << Gitlab::Utils.append_path(current_jira_installation.instance_url, '/-/jira_connect/oauth_application_ids') + request.content_security_policy.directives['connect-src'].concat(allowed_instance_connect_src) end def create_service @@ -77,4 +79,11 @@ class JiraConnect::SubscriptionsController < JiraConnect::ApplicationController def allow_rendering_in_iframe response.headers.delete('X-Frame-Options') end + + def allowed_instance_connect_src + [ + Gitlab::Utils.append_path(current_jira_installation.instance_url, '/-/jira_connect/'), + Gitlab::Utils.append_path(current_jira_installation.instance_url, '/api/') + ] + end end |