Fix for Vue js not loading due to CSP :(

snipe · Jun 25, 2020 · 339bddd · 339bddd
1 parent 35b9cf4
commit 339bddd
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/Http/Middleware/SecurityHeaders.php b/app/Http/Middleware/SecurityHeaders.php
@@ -87,7 +87,7 @@ public function handle($request, Closure $next)
         }
 
 
-        // This defaults to false to maintain backwards compatibility
+        // This defaults to false to maintain backwards compatibility for
         // people who are not running Snipe-IT over TLS (shame, shame, shame!)
         // Seriously though, please run Snipe-IT over TLS. Let's Encrypt is free.
         // https://letsencrypt.org
@@ -102,7 +102,7 @@ public function handle($request, Closure $next)
         if ((config('app.debug')!='true')  || (config('app.enable_csp')=='true')) {
             $csp_policy[] = "default-src 'self'";
             $csp_policy[] = "style-src 'self' 'unsafe-inline'";
-            $csp_policy[] = "script-src 'self' 'unsafe-inline'";
+            $csp_policy[] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'";
             $csp_policy[] = "connect-src 'self'";
             $csp_policy[] = "object-src 'none'";
             $csp_policy[] = "font-src 'self' data:";