* Serve files in old file-viewer through FileResponse.
Fixes bug 1566954
The old file-viewer will be going away "soon" anyway so we should be
using the same technique as for the new one.
The problem here specifically is that when going through Nginx via
X-Accel-Redirect nginx isn't setting proper CSP headers for the
download. Serving the files ourselves allows us to much easier restrict
CSP in the future even further.
* Explicitly restrict CSP config on download endpoints.
* Set report uri in settings.py too
* Explicitly add frame-ancestors
* Remove outdated test
Этот файл содержит неоднозначные символы Юникода, которые могут быть перепутаны с другими в текущей локали. Если это намеренно, можете спокойно проигнорировать это предупреждение. Используйте кнопку Экранировать, чтобы подсветить эти символы.
.. image:: https://img.shields.io/badge/%E2%9D%A4-code%20of%20conduct-blue.svg
:target: https://github.com/mozilla/addons-server/blob/master/CODE_OF_CONDUCT.md
:alt: Code of conduct
.. image:: https://travis-ci.org/mozilla/addons-server.svg?branch=master
:target: https://travis-ci.org/mozilla/addons-server
.. image:: https://pyup.io/repos/github/mozilla/addons-server/shield.svg
:target: https://pyup.io/repos/github/mozilla/addons-server/
:alt: Updates
.. image:: https://codecov.io/gh/mozilla/addons-server/branch/master/graph/badge.svg
:target: https://codecov.io/gh/mozilla/addons-server
.. image:: https://pyup.io/repos/github/mozilla/addons-server/python-3-shield.svg
:target: https://pyup.io/repos/github/mozilla/addons-server/
:alt: Python 3
Addons-Server
=============
Welcome to the Addons Server repository! Please feel free to visit the web page of the current project hosted on `addons.mozilla.org`_. If you want to install it follow our guide located in `install docs`_. We'd love your help! You can come talk to us on `irc.mozilla.org #amo`_ if you have any questions.
Please report bugs here: https://github.com/mozilla/addons/issues or https://github.com/mozilla/addons-server/issues
You can access the AMO dev environment at https://addons-dev.allizom.org/ and the AMO stage environment at https://addons.allizom.org/
You can join our mailing list at https://mail.mozilla.org/listinfo/dev-addons
.. _`addons.mozilla.org`: https://addons.mozilla.org
.. _`install docs`: https://addons-server.readthedocs.io/en/latest/topics/install/docker.html
.. _`irc.mozilla.org #amo`: irc://irc.mozilla.org/amo
.. marker-for-security-bug-inclusion-do-not-remove
Security Bug Reports
--------------------
This code and its associated production web page are included in the Mozilla’s web and services `bug bounty program`_. If you find a security vulnerability, please submit it via the process outlined in the program and `FAQ pages`_. Further technical details about this application are available from the `Bug Bounty Onramp page`_.
Please submit all security-related bugs through Bugzilla using the `web security bug form`_. Never submit security-related bugs through a Github Issue or by email.
.. _bug bounty program: https://www.mozilla.org/en-US/security/web-bug-bounty/
.. _FAQ pages: https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/
.. _Bug Bounty Onramp page: https://wiki.mozilla.org/Security/BugBountyOnramp/
.. _web security bug form: https://bugzilla.mozilla.org/form.web.bounty
d6c44135ce