Merge pull request #469 from UN-OCHA/develop

Deploy 21-08-2024

config/core.extension.yml

@@ -57,6 +57,7 @@ module:
   search_api_db: 0
   seckit: 0
   select_a11y: 0
+  select_a11y_facets: 0
   serialization: 0
   social_api: 0
   social_auth: 0

config/seckit.settings.yml

@@ -8,16 +8,16 @@ seckit_xss:
       webkit: false
     report-only: false
     default-src: "'self'"
-    script-src: "'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com www.gstatic.com https://*.google.com https://*.googletagmanager.com *.google-analytics.com https://tagmanager.google.com"
+    script-src: "'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com www.gstatic.com https://*.google.com https://*.googletagmanager.com *.google-analytics.com https://tagmanager.google.com https://www.googleadservices.com  https://googleads.g.doubleclick.net"
     object-src: "'none'"
     style-src: "'self' 'unsafe-inline' https://googletagmanager.com https://tagmanager.google.com fonts.googleapis.com https://www.google.com"
-    img-src: "'self' data: https://*.google-analytics.com https://*.googletagmanager.com gstatic.com https://www.google.com https://google.com *.youtube.com *.placeholder.com"
+    img-src: "'self' data: https://*"
     media-src: "'none'"
-    frame-src: "'self' https://www.googletagmanager.com"
+    frame-src: "'self' https://www.googletagmanager.com https://bid.g.doubleclick.net https://td.doubleclick.net"
     frame-ancestors: "'self'"
     child-src: "'self'"
     font-src: "'self' data: fonts.gstatic.com"
-    connect-src: "'self' https://*.google-analytics.com https://analytics.google.com https://*.analytics.google.com https://*.googletagmanager.com *.placeholder.com"
+    connect-src: "'self' https://*"
     report-uri: /report-csp-violation
     upgrade-req: false
     policy-uri: ''