From 838687a3ae47494fa7d0f2ab9b3e66f601e56552 Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Mon, 1 Oct 2018 16:58:14 -0600
Subject: [PATCH 1/2] fix: added support for static uri in CSP header for
 social callback

---
 services/passport.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/services/passport.js b/services/passport.js
index 4b96d2352..d7749e615 100644
--- a/services/passport.js
+++ b/services/passport.js
@@ -97,6 +97,11 @@ const HandleGenerateCredentials = (req, res, next) => (err, user) => {
   res.json({ user, token });
 };
 
+const generateAuthPopupCallbackCSP = req =>
+  req.locals.STATIC_URL && req.locals.BASE_URL !== req.locals.STATIC_URL
+    ? `default-src 'self' ${req.locals.STATIC_URL};`
+    : "default-src 'self';";
+
 /**
  * Returns the response to the login attempt via a popup callback with some JS.
  */
@@ -106,7 +111,7 @@ const HandleAuthPopupCallback = (req, res, next) => (err, user) => {
   res.header('Pragma', 'no-cache');
 
   // Ensure the only scripts that can run here are those on the Talk domain.
-  res.header('Content-Security-Policy', "default-src 'self';");
+  res.header('Content-Security-Policy', generateAuthPopupCallbackCSP(req));
 
   // Attach static locals to the response locals object.
   attachStaticLocals(res.locals);

From 05283b08f78953498078107bd1354f5b3ce0024a Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Mon, 1 Oct 2018 16:58:58 -0600
Subject: [PATCH 2/2] chore: version bump

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 406524517..a024e5de1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "talk",
-  "version": "4.6.3",
+  "version": "4.6.4",
   "description": "A better commenting experience from Mozilla, The New York Times, and the Washington Post. https://coralproject.net",
   "main": "app.js",
   "private": true,