Merge remote-tracking branch 'upstream/main'

Author: Arne Tarara - Automated

.env.example

@@ -6,6 +6,8 @@
 
 # Careful about the quoting of directives! It is easy to break.
 # CSP_DEFAULT_SRC="'self'"
-
-# Enable this rule to allow font awesome to load from CDN
-# CSP_FONT_SRC="'self', https://cdnjs.cloudflare.com"
+# CSP_SCRIPT_SRC="'self', 'report-sample'"
+# CSP_STYLE_SRC="'self', 'report-sample'"
+# CSP_IMG_SRC="'self', blob:, i.ytimg.com, www.gravatar.com"
+# CSP_CONNECT_SRC="'self', releases.wagtail.org"
+# CSP_FRAME_SRC="'self', www.youtube.com"

bakerydemo/settings/base.py

@@ -249,5 +249,7 @@
         CSP_BASE_URI = os.environ.get("CSP_BASE_URI").split(",")
     if "CSP_OBJECT_SRC" in os.environ:
         CSP_OBJECT_SRC = os.environ.get("CSP_OBJECT_SRC").split(",")
+    if "CSP_FRAME_SRC" in os.environ:
+        CSP_FRAME_SRC = os.environ.get("CSP_FRAME_SRC").split(",")
     if "CSP_REPORT_URI" in os.environ:
         CSP_REPORT_URI = os.environ.get("CSP_REPORT_URI")