fix: add unsafe-eval only in dev env

1 files changed, 6 insertions, 1 deletions

diff --git a/appinfo/app.php b/appinfo/app.php
index 7f7789c..e5253d4 100755
--- a/appinfo/app.php
+++ b/appinfo/app.php
@@ -38,7 +38,12 @@ if(class_exists('\\OCP\\AppFramework\\Http\\EmptyContentSecurityPolicy')) {
 	$policy->addAllowedStyleDomain('\'self\'');
 	$policy->addAllowedStyleDomain('\'unsafe-inline\'');
 
-	$policy->addAllowedScriptDomain('\'self\' \'unsafe-eval\'');
+	$policy->addAllowedScriptDomain('\'self\'');
+
+	if ($config->getSystemValue('jsxc.environment', 'production') === 'development') {
+		// required for source maps
+		$policy->addAllowedScriptDomain('\'unsafe-eval\'');
+	}
 
 	$policy->addAllowedImageDomain('\'self\'');
 	$policy->addAllowedImageDomain('data:');