Set a content security policy in .htaccess

My Web site disables JavaScript by default, so we need to override
that if the Web editor is going to work.

diff --git a/.htaccess b/.htaccess
index fa1c09fc82353ef208bef3718998f4f6ebf879f5..c1bbf5592ba11f3766bb62eaf7f94a88771bd735 100644 (file)
--- a/.htaccess
+++ b/.htaccess
@@ -6,3 +6,4 @@ AddType font/otf;outlines=CFF .otf
 </FilesMatch>
 AddOutputFilterByType DEFLATE application/xhtml+xml text/css font/otf \
  text/plain text/x-csrc application/postscript
+Header set Content-Security-Policy "object-src 'none';"