adjust dependabot, remove allowEvalScript()

Signed-off-by: Benjamin Brahmer <info@b-brahmer.de>
nextcloud · Oct 24, 2023 · 1632f5b · 1632f5b
1 parent f53159b
commit 1632f5b
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -7,7 +7,7 @@ version: 2
 updates:
   # Maintain dependencies for npm
   - package-ecosystem: "npm"
-    directory: "/js"
+    directory: "/"
     schedule:
       interval: "daily"
     labels:

diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php
@@ -96,7 +96,6 @@ public function index(): TemplateResponse
         $csp->addAllowedImageDomain('*')
             ->addAllowedMediaDomain('*')
             ->addAllowedConnectDomain('*')// chrome breaks on audio elements
-            ->allowEvalScript(true)
             ->addAllowedFrameDomain('https://youtube.com')
             ->addAllowedFrameDomain('https://www.youtube.com')
             ->addAllowedFrameDomain('https://player.vimeo.com')