Remove deprecated CSP child-src

It's been probably long enough since https://github.com/FreshRSS/FreshRSS/pull/1099
6 years ago · 75356c64a2
parent 75a802f623
commit 75356c64a2
1 changed files with 1 additions and 1 deletions
--- a/app/FreshRSS.php
+++ b/app/FreshRSS.php
@ -117,7 +117,7 @@ class FreshRSS extends Minz_FrontController {
 					}
 				}, FreshRSS_Context::$user_conf->sharing));
 				$connectSrc = count($urlToAuthorize) ? sprintf("; connect-src 'self' %s", implode(' ', $urlToAuthorize)) : '';
-				header(sprintf("Content-Security-Policy: default-src 'self'; child-src *; frame-src *; img-src * data:; media-src *%s", $connectSrc));
+				header(sprintf("Content-Security-Policy: default-src 'self'; frame-src *; img-src * data:; media-src *%s", $connectSrc));
 				break;
 			case 'stats':
 				header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'");