-
+
-
- {% for screenshot in object.screenshots.all %}
+
+ {% for video in videos %}
+
+
+ {% endfor %}
+ {% for screenshot in screenshots %}
+
{% endfor %}
-
+
{% endif %}
+ {% endwith %}
+ {% endwith %}
{% if object.is_server_bundled %}
diff --git a/nextcloudappstore/core/views.py b/nextcloudappstore/core/views.py
index f0f557f9d6e..fcebf842084 100644
--- a/nextcloudappstore/core/views.py
+++ b/nextcloudappstore/core/views.py
@@ -4,7 +4,7 @@
"""
import json
-from urllib.parse import urlencode
+from urllib.parse import urlencode, urlparse
from django.conf import settings
from django.contrib.auth.mixins import LoginRequiredMixin
@@ -60,6 +60,7 @@ class AppDetailView(DetailView):
queryset = App.objects.prefetch_related(
"releases",
"screenshots",
+ "videos",
"co_maintainers",
"translations",
).select_related("owner")
@@ -67,6 +68,20 @@ class AppDetailView(DetailView):
slug_field = "id"
slug_url_kwarg = "id"
+ def render_to_response(self, context, **response_kwargs):
+ response = super().render_to_response(context, **response_kwargs)
+ hosts = sorted(
+ {
+ f"{parsed.scheme}://{parsed.netloc}"
+ for video in self.object.videos.all()
+ for parsed in (urlparse(video.url),)
+ if parsed.scheme and parsed.netloc
+ }
+ )
+ if hosts:
+ response._csp_update = {"frame-src": hosts}
+ return response
+
def post(self, request, id):
post_data = json.loads(request.body) if request.content_type == "application/json" else request.POST
if request.user.is_authenticated and ("decision" in post_data or "appeal" in post_data):