Merge pull request #1021 from matrix-org/erikj/mediasecurity_policy

Set `Content-Security-Policy` on media repo
matrix-org · Aug 17, 2016 · 2a0d8f8 · 2a0d8f8
2 parents 0d7cef0 + 0af9e1a
commit 2a0d8f8
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/synapse/rest/media/v1/download_resource.py b/synapse/rest/media/v1/download_resource.py
@@ -45,6 +45,7 @@ def render_GET(self, request):
     @request_handler()
     @defer.inlineCallbacks
     def _async_render_GET(self, request):
+        request.setHeader("Content-Security-Policy", "sandbox")
         server_name, media_id, name = parse_media_id(request)
         if server_name == self.server_name:
             yield self._respond_local_file(request, media_id, name)