discourse email activation no longer works due to Content Security Policy violation [closed] - discourse

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 3 years ago.
Improve this question
I boostrapped discourse using my custom app.yml which uses the cloudflare template like so:
templates:
- "templates/postgres.template.yml"
- "templates/redis.template.yml"
- "templates/web.template.yml"
- "templates/web.ratelimited.template.yml"
- "templates/web.socketed.template.yml"
- "templates/sshd.template.yml"
- "templates/cloudflare.template.yml"
Then I bootstrapped the image like so:
./launcher bootstrap app &&\
./launcher start app
I then register my account, and try clicking on the activation link on my discourse page, and NOTHING happens. Looking at dev tools, I see this error:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'report-sample' http://myfancydomain.com/logs/ http://myfancydomain.com/sidekiq/ http://myfancydomain.com/mini-profiler-resources/ http://myfancydomain.com/assets/ http://myfancydomain.com/brotli_asset/ http://myfancydomain.com/extra-locales/ http://myfancydomain.com/highlight-js/ http://myfancydomain.com/javascripts/ http://myfancydomain.com/plugins/ http://myfancydomain.com/theme-javascripts/ http://myfancydomain.com/svg-sprite/". Either the 'unsafe-inline' keyword, a hash ('sha256-T1n9N/v2ZUyCGncqaO0MgcESijK4iDg9nXYaamEO+bY='), or a nonce ('nonce-...') is required to enable inline execution.
I have NO clue what this error means - any clues as to how to solve it would be great.

You've included the cloudflare template which probably means you're using it for SSL.
But your CSP has all http schemes instead of https. If you access via https but the CSP says http, that's a mismatch.
You need to tell Discourse that it's behind https if that's the case. Try:
SiteSetting.force_https = true
at the rails console.

Related

Health Check for a Web Url [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Closed 8 years ago.
Improve this question
I'm trying to implement a "health check" for my web site, basically want to write some code in java or use some freeware that can keep pinging my website url every 10 mins and see if it's up and available, if it's down for some reason would like to log that to a log file (or send an email etc).
I did search in net but didn't get any specific implementation for this, pls suggest if you know any.
Please note - my cloud provider does not provide such a feature as I have only a trail license with them, so this will be something like a temp arrangement till we move into the professional mode with the cloud provider.
You can easily put something together for this in Java
Hit your URL with the java.net API like so
URI uri = new URI("http://www.nonexistent.com/");
URL url = uri.toURL();
InputStream in = url.openStream();
which will throw an exception if the site is down.
So put it inside a try/catch block and do what you need to do in the catch. (you can send a mail using the java mail api - just do a google to find enough examples)
And finally you can make this run according to a schedule using java.util.Timer API.
Will leave the specifics up to you to figure out :)

How can I get thin (the webserver) to be accessible outside of my home network? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
I followed the simple instructions for installing the "thin" web server in my ruby application via: http://code.macournoyer.com/thin/
I can see that it is being called when I "start" it. However, while I am able to access the web server using "localhost". I would like to be able to access it using my ip address, or some other way - so that I can send a colleague that's not on my home network to my test app.
while I have fiddled around with some variables (port, host, etc) I am still missing something.
How can I access my thin server from outside of my home network?
Note: I do not have a firewall enabled. - Any thoughts on how to resolve this?
This is more of a network issue than a server setting issue.
You would probably need to set your router to redirect incoming accesses to your computer, how to do will vary from router to router.
In most cases there should be a menu in the router that lets you specify a port, and what internal IP address you want the request to be routed to, set that to your machines LAN IP address, and it should be good to go.
You will probably get a better answer at Server Fault or Super User.

Mvc Facebook Application Debugging at localhost [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Questions asking for code must demonstrate a minimal understanding of the problem being solved. Include attempted solutions, why they didn't work, and the expected results. See also: Stack Overflow question checklist
Closed 9 years ago.
Improve this question
I have a mvc proj which is page of facebook application. I want to debug it in my localhost when ı call it from facebook. Is it possible ?
Yes, provide the Site_url/Cavas_url to http://localhost/yourapp/ and enable the sandbox mode
There are options for testing/debugging the application from localhost, specifically: site url and sandbox (yes/no). But changing these settings of an application that already is used in production will break the application in for your visitors.
A common method is to create multiple applications, where the amount depends on your development method. For example: one for development, one for testing and one for production. The development app will point to something like: localhost:8000, the test app will point to something like test.yourapplication.com and the development app will point to www.yourapplication.com.

I have to pay for Custom-domain SSL on Heroku to get rid of the warning signs right? [closed]

Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
I just want to make sure before I go purchase anything.
I have an app on heroku. The URL is myappname.herokuapps.com on cedar stack.
I purchased a custom domain on godady and set up CNAME to make the forwarding work. I am able to use my custom domain to access the app on heroku. The problem is that, I get the browser warnings on FF, Chrome, IE, etc. The message is below:
This is probably not the site you are looking for!
You attempted to reach www.mydomain.com, but instead you actually reached a server identifying itself as *.herokuapp.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of www.mydomain.com.
You should not proceed, especially if you have never seen this warning before for this site.
My questions are:
I need to purchase a SSL to fix this right?
Do I need to get a wildcard certification or do any of them work?
Any recommendations on where to purchase it? I saw some options such as RapidSSL, SSL Endpoint add-on on Heroku, etc.
NO! You probably just didn't configured properly. Here you can check the steps. You probably didn't get the addon for custom domains.
The ssl add-on is only required if you want to use SSL and https. You should be able to browse to http://mycustomdomain.com/ without getting a warning. Going to https://mycustomdomain.com/ will yield the warning unless you add the ssl add-on and a certificate for the domain.

Accessing Live Site Domain [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Closed 8 years ago.
This question appears to be off-topic because it lacks sufficient information to diagnose the problem. Describe your problem in more detail or include a minimal example in the question itself.
This question does not appear to be about programming within the scope defined in the help center.
Improve this question
I cant access the live domain for the Rails 3 application i created on my macbook. I can obviously access localhost:3000 for testing purposes, but when i log on to my live domain http://truthpage.me it sends the request and eventually times out. Doesnt work in any browser on my machine only. We are hosting the app with heroku if that makes any difference. Do any of you guys have a solution to why this doesnt work? thank you for your time.
Try flushing your DNS cache:
$> dscacheutil -flushcache
Also, ensure there's nothing causing an unintentional redirection in your hosts file for that domain:
$> cat /private/etc/hosts
Is this working from other machines or locations? If this is working from other location then it may be some issue with your local ISP. If you recently changed DNS records then it can also be a DNS propagation issue. Sometimes, it takes 24 hours to propagate the DNS across the globe.

Resources