Change Details

Related bugs: T28508 Upload.wikimedia.org should have a restrictive security policy as a deference against svgs loading external resources. I think something like: Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data:; media-src data:; sandbox would be good. Probably also X-Content-security-policy too for MSIE and old firefox Open question: What about reporting. Do we need it for upload and if so where would we report to

Related bugs: T28508 Upload.wikimedia.org should have a restrictive security policy as a deference against svgs loading external resources. I think something like: ``` Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data:; media-src data:; sandbox ``` would be good. Probably also X-Content-security-policy too for MSIE and old firefox Open question: What about reporting. Do we need it for upload and if so where would we report to

Related bugs: T28508 Upload.wikimedia.org should have a restrictive security policy as a deference against svgs loading external resources. I think something like: ``` Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data:; media-src data:; sandbox ``` would be good. Probably also X-Content-security-policy too for MSIE and old firefox Open question: What about reporting. Do we need it for upload and if so where would we report to