Add CSP for GTM.

dpage · dpage · commit 95e4ef533d05 · 2020-07-02T16:26:08.000+01:00
diff --git a/pgweb/util/middleware.py b/pgweb/util/middleware.py
@@ -46,10 +46,10 @@ def __call__(self, request):
         sources = OrderedDict([
             ('default', ["'self'", ]),
             ('img', ['*', 'data:', ]),
-            ('script', ["'self'", "www.google-analytics.com", "ssl.google-analytics.com", "data:"]),
+            ('script', ["'unsafe-eval'", "'self'", "www.google-analytics.com", "ssl.google-analytics.com", "www.googletagmanager.com", "tagmanager.google.com", "data:"]),
             ('connect', ["'self'", "www.google-analytics.com", "ssl.google-analytics.com"]),
             ('media', ["'self'", ]),
-            ('style', ["'self'", "fonts.googleapis.com"]),
+            ('style', ["'self'", "fonts.googleapis.com", "tagmanager.google.com"]),
             ('font', ["'self'", "fonts.gstatic.com", "data:", ]),
         ])
         if hasattr(response, 'x_allow_extra_sources'):
