{"action":"created","issue":{"url":"https://api.github.com/repos/matrix-org/synapse/issues/3578","repository_url":"https://api.github.com/repos/matrix-org/synapse","labels_url":"https://api.github.com/repos/matrix-org/synapse/issues/3578/labels{/name}","comments_url":"https://api.github.com/repos/matrix-org/synapse/issues/3578/comments","events_url":"https://api.github.com/repos/matrix-org/synapse/issues/3578/events","html_url":"https://github.com/matrix-org/synapse/pull/3578","id":343594124,"node_id":"MDExOlB1bGxSZXF1ZXN0MjAzMTg5NjQy","number":3578,"title":"added \"media-src: 'self'\" to CSP for resources","user":{"login":"remjey","id":13684203,"node_id":"MDQ6VXNlcjEzNjg0MjAz","avatar_url":"https://avatars2.githubusercontent.com/u/13684203?v=4","gravatar_id":"","url":"https://api.github.com/users/remjey","html_url":"https://github.com/remjey","followers_url":"https://api.github.com/users/remjey/followers","following_url":"https://api.github.com/users/remjey/following{/other_user}","gists_url":"https://api.github.com/users/remjey/gists{/gist_id}","starred_url":"https://api.github.com/users/remjey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/remjey/subscriptions","organizations_url":"https://api.github.com/users/remjey/orgs","repos_url":"https://api.github.com/users/remjey/repos","events_url":"https://api.github.com/users/remjey/events{/privacy}","received_events_url":"https://api.github.com/users/remjey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-23T11:30:11Z","updated_at":"2018-09-18T18:11:52Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/matrix-org/synapse/pulls/3578","html_url":"https://github.com/matrix-org/synapse/pull/3578","diff_url":"https://github.com/matrix-org/synapse/pull/3578.diff","patch_url":"https://github.com/matrix-org/synapse/pull/3578.patch"},"body":"Synapse doesn’t allow for media resources to be played directly from\r\nChrome. It is a problem for users on other networks (e.g. IRC)\r\ncommunicating with Matrix users through a gateway. The gateway sends\r\nthem the raw URL for the resource when a Matrix user uploads a video\r\nand the video cannot be played directly in Chrome using that URL.\r\n\r\nChrome argues it is not authorized to play the video because of the\r\nContent Security Policy. Chrome checks for the \"media-src\" policy which\r\nis missing, and defauts to the \"default-src\" policy which is \"none\".\r\n\r\nAs Synapse already sends \"object-src: 'self'\" I thought it wouldn’t be\r\na problem to add \"media-src: 'self'\" to the CSP to fix this problem."},"comment":{"url":"https://api.github.com/repos/matrix-org/synapse/issues/comments/422493771","html_url":"https://github.com/matrix-org/synapse/pull/3578#issuecomment-422493771","issue_url":"https://api.github.com/repos/matrix-org/synapse/issues/3578","id":422493771,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMjQ5Mzc3MQ==","user":{"login":"turt2live","id":1190097,"node_id":"MDQ6VXNlcjExOTAwOTc=","avatar_url":"https://avatars2.githubusercontent.com/u/1190097?v=4","gravatar_id":"","url":"https://api.github.com/users/turt2live","html_url":"https://github.com/turt2live","followers_url":"https://api.github.com/users/turt2live/followers","following_url":"https://api.github.com/users/turt2live/following{/other_user}","gists_url":"https://api.github.com/users/turt2live/gists{/gist_id}","starred_url":"https://api.github.com/users/turt2live/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/turt2live/subscriptions","organizations_url":"https://api.github.com/users/turt2live/orgs","repos_url":"https://api.github.com/users/turt2live/repos","events_url":"https://api.github.com/users/turt2live/events{/privacy}","received_events_url":"https://api.github.com/users/turt2live/received_events","type":"User","site_admin":false},"created_at":"2018-09-18T18:11:52Z","updated_at":"2018-09-18T18:11:52Z","author_association":"MEMBER","body":"Note: Whatever happens here, the official suggestion in the spec should be updated alongside it: https://matrix.org/docs/spec/client_server/r0.4.0.html#id112"}}
{"actor":{"display_login":"turt2live"}}