From 4b2ed6677aa98920d0bc1e1192feeada23064403 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A9ven?= <meven.car@collabora.com>
Date: Wed, 20 Nov 2024 15:19:03 +0100
Subject: [PATCH] Update coolwsd.xml.in add concrete link to frame-ancestor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Méven Car <meven.car@collabora.com>
Change-Id: I95f186820737c29bb2aa177db3bf07d40188c839
---
 coolwsd.xml.in | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/coolwsd.xml.in b/coolwsd.xml.in
index d354da1a6f670..540d4f487de90 100644
--- a/coolwsd.xml.in
+++ b/coolwsd.xml.in
@@ -184,7 +184,13 @@
         <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
         <host desc="Localhost access by name">localhost</host>
       </lok_allow>
-      <content_security_policy desc="Customize the CSP header by specifying one or more policy-directive, separated by semicolons. See w3.org/TR/CSP2"></content_security_policy>
+      <content_security_policy desc="Customize the CSP header by specifying one or more policy-directive, separated by semicolons. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy">
+      <!-- example:
+      connect-src 'self' collabora-online-server.local;
+      frame-src 'self' server-to-inject-iframe-from.xyz;
+      connect-src 'self' server-to-inject-js-from.io
+      -->
+      </content_security_policy>
       <frame_ancestors desc="OBSOLETE: Use content_security_policy. Specify who is allowed to embed the Collabora Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
       <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs>