{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/addons-server/issues/3434","repository_url":"https://api.github.com/repos/mozilla/addons-server","labels_url":"https://api.github.com/repos/mozilla/addons-server/issues/3434/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/addons-server/issues/3434/comments","events_url":"https://api.github.com/repos/mozilla/addons-server/issues/3434/events","html_url":"https://github.com/mozilla/addons-server/issues/3434","id":175500340,"number":3434,"title":"Upgrade django-csp","user":{"login":"muffinresearch","id":1514,"avatar_url":"https://avatars.githubusercontent.com/u/1514?v=3","gravatar_id":"","url":"https://api.github.com/users/muffinresearch","html_url":"https://github.com/muffinresearch","followers_url":"https://api.github.com/users/muffinresearch/followers","following_url":"https://api.github.com/users/muffinresearch/following{/other_user}","gists_url":"https://api.github.com/users/muffinresearch/gists{/gist_id}","starred_url":"https://api.github.com/users/muffinresearch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffinresearch/subscriptions","organizations_url":"https://api.github.com/users/muffinresearch/orgs","repos_url":"https://api.github.com/users/muffinresearch/repos","events_url":"https://api.github.com/users/muffinresearch/events{/privacy}","received_events_url":"https://api.github.com/users/muffinresearch/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/mozilla/addons-server/milestones/28","html_url":"https://github.com/mozilla/addons-server/milestones/2016-09-15%20(51.4)","labels_url":"https://api.github.com/repos/mozilla/addons-server/milestones/28/labels","id":1975657,"number":28,"title":"2016-09-15 (51.4)","description":"","creator":{"login":"muffinresearch","id":1514,"avatar_url":"https://avatars.githubusercontent.com/u/1514?v=3","gravatar_id":"","url":"https://api.github.com/users/muffinresearch","html_url":"https://github.com/muffinresearch","followers_url":"https://api.github.com/users/muffinresearch/followers","following_url":"https://api.github.com/users/muffinresearch/following{/other_user}","gists_url":"https://api.github.com/users/muffinresearch/gists{/gist_id}","starred_url":"https://api.github.com/users/muffinresearch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffinresearch/subscriptions","organizations_url":"https://api.github.com/users/muffinresearch/orgs","repos_url":"https://api.github.com/users/muffinresearch/repos","events_url":"https://api.github.com/users/muffinresearch/events{/privacy}","received_events_url":"https://api.github.com/users/muffinresearch/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":5,"state":"open","created_at":"2016-08-31T17:49:07Z","updated_at":"2016-09-08T13:53:38Z","due_on":"2016-09-13T00:00:00Z","closed_at":null},"comments":4,"created_at":"2016-09-07T13:19:12Z","updated_at":"2016-09-08T15:44:40Z","closed_at":"2016-09-07T13:56:14Z","body":"* Upgrade django-csp\r\n* Use the `child-src`, `base-uri` and `form-action` directives.\r\n\r\n## Qa notes for testing this:\r\n\r\n1. Make a request and look at the CSP headers:\r\n    * `child-src` settings should match the same values for `frame-src`\r\n    * `form-action` should be present and set to `'self'` and `https://developer.mozilla.org`\r\n    * `base-uri` should be present and set to `'self'` and the relevant host for the server you are on.\r\n2. Change the markup  and look for CSP errors.\r\n   * Modify the action attribute of a form (e.g. search) to a different site and you'll see a CSP error if you submit the search relating to violation of the `form-action` directive.\r\n   * Add a `<base>` element with an `href` attribute pointing to a different site and you'll see a CSP error relating to violation of the `base-uri` directive.\r\n3. The base-uri should still work on services.a.m.o (for the legacy discovery pane) - please check there's no issues here with links out to AMO.\r\n4. The only other special search action is the devhub search which points to MDN, this should still work without errors.\r\n\r\nKnown issues: \r\n\r\nYou may see CSP violations re: `about`. See the separate issue for that: https://github.com/mozilla/addons-server/issues/3440"},"comment":{"url":"https://api.github.com/repos/mozilla/addons-server/issues/comments/245641409","html_url":"https://github.com/mozilla/addons-server/issues/3434#issuecomment-245641409","issue_url":"https://api.github.com/repos/mozilla/addons-server/issues/3434","id":245641409,"user":{"login":"madalincm","id":15685441,"avatar_url":"https://avatars.githubusercontent.com/u/15685441?v=3","gravatar_id":"","url":"https://api.github.com/users/madalincm","html_url":"https://github.com/madalincm","followers_url":"https://api.github.com/users/madalincm/followers","following_url":"https://api.github.com/users/madalincm/following{/other_user}","gists_url":"https://api.github.com/users/madalincm/gists{/gist_id}","starred_url":"https://api.github.com/users/madalincm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/madalincm/subscriptions","organizations_url":"https://api.github.com/users/madalincm/orgs","repos_url":"https://api.github.com/users/madalincm/repos","events_url":"https://api.github.com/users/madalincm/events{/privacy}","received_events_url":"https://api.github.com/users/madalincm/received_events","type":"User","site_admin":false},"created_at":"2016-09-08T15:44:40Z","updated_at":"2016-09-08T15:44:40Z","body":"Everything looks good except one thing. When opening https://services.addons-dev.allizom.org/en-US/firefox/discovery/pane/pane/46.0/strict I can see this:\r\n![cspdiscopane](https://cloud.githubusercontent.com/assets/15685441/18356118/212c66a4-75f4-11e6-806b-6de7e063a600.png)\r\n\r\nThis only happens in 48 (that error is not displayed in nightly). So I think is related to #3440 \r\nWhat do you think @muffinresearch "}}
{"actor":{"display_login":"madalincm"}}