Starting to lock down the webviews permissions

Relates to #22
mountainash · Mar 20, 2020 · eb5d894 · eb5d894
1 parent 2920830
commit eb5d894
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 4 deletions.
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "mixcloud-play",
-	"version": "0.10.3",
+	"version": "0.10.4",
 	"description": "The Mixcloud desktop client",
 	"keywords": [
 		"music",

diff --git a/src/renderer/index.html b/src/renderer/index.html
@@ -3,6 +3,7 @@
 <head>
 	<meta charset="utf-8">
 	<title>Mixcloud Play</title>
+	<meta http-equiv="Content-Security-Policy" content="default-src mixcloud.com  *.mixcloud.com; script-src 'unsafe-inline' 'self'; script-src-elem 'unsafe-inline' 'self'; style-src 'unsafe-inline' 'self'; style-src-elem 'unsafe-inline' 'self'">
 </head>
 <body>
 	<div id="hud" style="display:none">
@@ -19,12 +20,9 @@
 	</div>
 	<webview
 		id="webview"
-		allowpopups
-		disablewebsecurity
 		preload="./preload.js"
 		src="https://www.mixcloud.com/"
 		partition="persist:mixcloud"
-		webpreferences="nativeWindowOpen=true;experimentalFeatures"
 	></webview>
 </body>
 </html>