From 4725f24406fd5ead7413a9c4b1492e1bd6b2a967 Mon Sep 17 00:00:00 2001
From: Dan Percic <dan.percic.ext@knecon.com>
Date: Mon, 15 Jan 2024 20:11:34 +0200
Subject: [PATCH] RED-8128 change frame ancestors to self

---
 docker/common/nginx/nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/common/nginx/nginx.conf b/docker/common/nginx/nginx.conf
index 8ca658a0d..5834f1151 100644
--- a/docker/common/nginx/nginx.conf
+++ b/docker/common/nginx/nginx.conf
@@ -5,7 +5,7 @@ server {
   server_tokens off;
   root /usr/share/nginx/html;
   # SSL stuff for cloudflare proxy-ing - ignores SSL certificate and uses SNI
-  add_header Content-Security-Policy "frame-ancestors 'none'; connect-src 'self' $API_URL $PDFTRON_ALLOWED_HOSTS; default-src 'self' $API_URL; script-src 'self' blob: data: 'unsafe-eval' 'unsafe-inline'; script-src-elem 'self' data: blob: 'unsafe-inline'; script-src-attr 'self' data:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:";
+  add_header Content-Security-Policy "frame-ancestors 'self'; connect-src 'self' $API_URL $PDFTRON_ALLOWED_HOSTS; default-src 'self' $API_URL; script-src 'self' blob: data: 'unsafe-eval' 'unsafe-inline'; script-src-elem 'self' data: blob: 'unsafe-inline'; script-src-attr 'self' data:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:";
 
   proxy_ssl_verify off;
   proxy_read_timeout 1m;