BKKVBU-2273 - changed CSP conf

diff --git a/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml b/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml
index 66fd065f1c6a09fa3e2d0921f346ce334a759d71..010bb00e347e08d774a9c2a2146210f85079d898 100644 (file)
--- a/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml
+++ b/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml
@@ -10,10 +10,6 @@ accounts::users:
     apply: true
     sudo: true
     group: apache
-  bastian.gutschke:
-    apply: true
-    group: apache
-    sudo: true
   markus.baumann:
     apply: true
     group: apache
@@ -25,10 +21,6 @@ accounts::users:
     apply: true
     sudo: true
     group: apache
-  romy.pohl:
-    apply: true
-    groups:
-      - apache
   santiago.nuneznegrillo:
     apply: true
     groups:
@@ -138,8 +130,8 @@ infra::profile::apache::pp_vhosts:
       # X-XSS-Protection set by helmetjs (https://helmetjs.github.io/)
       # - 'set X-XSS-Protection: "1; mode=block"'
       - 'set X-Frame-Options: "ALLOW-FROM https://dev-cms01-meine-krankenkasse-de.pixelpark.net"'
-      - "set Content-Security-Policy: \"default-src 'self'; img-src 'self' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com data:; font-src 'self' bkk-vorteilsrechner.de; style-src 'self' 'unsafe-inline' bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; script-src 'self' 'unsafe-inline' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com www.googletagmanager.com; child-src 'self' bkk-vorteilsrechner.de www.youtube-nocookie.com player.vimeo.com www.googletagmanager.com; frame-ancestors 'self'\""
-      - "set X-Content-Security-Policy: \"default-src 'self'; img-src 'self' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com data:; font-src 'self' bkk-vorteilsrechner.de; style-src 'self' 'unsafe-inline' bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; script-src 'self' 'unsafe-inline' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com www.googletagmanager.com; child-src 'self' bkk-vorteilsrechner.de www.youtube-nocookie.com player.vimeo.com www.googletagmanager.com; frame-ancestors 'self'\""
+      - "set Content-Security-Policy: \"default-src 'self'; img-src 'self' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com data:; font-src 'self' bkk-vorteilsrechner.de; style-src 'self' 'unsafe-inline' bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com www.googletagmanager.com; child-src 'self' bkk-vorteilsrechner.de www.youtube-nocookie.com player.vimeo.com www.googletagmanager.com; frame-ancestors 'self'\""
+      - "set X-Content-Security-Policy: \"default-src 'self'; img-src 'self' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com data:; font-src 'self' bkk-vorteilsrechner.de; style-src 'self' 'unsafe-inline' bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com www.googletagmanager.com; child-src 'self' bkk-vorteilsrechner.de www.youtube-nocookie.com player.vimeo.com www.googletagmanager.com; frame-ancestors 'self'\""
     headers_ssl:
       - 'always set Strict-Transport-Security "max-age=31556926"'
     custom_fragment: |