[openstreetmap/openstreetmap-website] Download of osmChange file blocked in iD editor (#2582)

[Christoph Müller]

The current Content Security Policy HTTP header of https://www.openstreetmap.org/edit (iD editor) prevents using the "download osmChange file" link in Firefox. The link is accessible when clicking on the "save" button. Clicking on the link currently triggers no change in the GUI but an error message in the browser console is logged:
 
    Content Security Policy: The page’s settings blocked the loading of a
    resource at blob:https://www.openstreetmap.org/<uuid> ("frame-src").
 
The current CSP is:
 
    default-src 'self'; ... frame-src 'self'; ...
 
I propose that `blob:` should be added after `frame-src`.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/2582
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20200409/0dbf7b09/attachment.htm>