From 8d12a4d8312974c26911fd9824a6f47d6aa23c4c Mon Sep 17 00:00:00 2001
From: lapineige <lapineige@users.noreply.github.com>
Date: Fri, 26 May 2023 09:36:33 +0200
Subject: [PATCH] Fix script injection

See https://poa.st/notice/AW21NSFdXhFPb2Zzai
---
 conf/nginx.conf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/conf/nginx.conf b/conf/nginx.conf
index 748f7f1..bf700f0 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -35,3 +35,7 @@ location / {
   # Include SSOWAT user panel.
   include conf.d/yunohost_panel.conf.inc;
 }
+
+location ~ ^/media {
+    add_header Content-Security-Policy "script-src 'none';";
+}