在编辑器视图中阻止的wordpress内容 - docker + nginx设置

Question

i’m用Docker和nginx设置WordPress站点，但是我遇到了一个问题，其中WordPress编辑器中的内容被阻止，并显示一条消息，“该内容被阻止了。联系网站所有者解决问题。”

设置详细信息：

1.  WordPress and MySQL are running in Docker containers.
2.  NGINX is used as a web server, with configurations to support SSL via Certbot.

配置摘要：

•   Docker Compose file includes MySQL, WordPress, and NGINX services.
•   NGINX config specifies SSL certificates and FastCGI handling for PHP requests.

我附上了我的docker-compose.yml和nginx配置的相关部分：

# Docker Compose
version : '3'

services:
  db:
    image: mysql:8.0
    container_name: wordpress_db
    restart: unless-stopped
    env_file: .env
    environment:
      - MYSQL_DATABASE=wordpress
    volumes:
      - rn_dbdata:/var/lib/mysql
    command: '--default-authentication-plugin=mysql_native_password'
    networks:
      - rn-network

  wordpress:
    depends_on:
      - db
    build:
      context: .
      dockerfile: Dockerfile.wordpress
      args:
        WC_GZD_ENCRYPTION_KEY: ${WC_GZD_ENCRYPTION_KEY}
    container_name: wordpress
    restart: unless-stopped
    env_file: .env
    environment:
      - WORDPRESS_DB_HOST=db:3306
      - WORDPRESS_DB_USER=${MYSQL_USER}
      - WORDPRESS_DB_PASSWORD=${MYSQL_PASSWORD}
      - WORDPRESS_DB_NAME=wordpress
    volumes:
      - rn_wordpress:/var/www/html
    networks:
      - rn-network

  webserver:
    depends_on:
      - wordpress
    image: nginx:1.27.2-alpine
    container_name: webserver
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - rn_wordpress:/var/www/html
      - ./nginx-conf:/etc/nginx/conf.d
      - certbot-etc:/etc/letsencrypt
    networks:
      - rn-network
...

NGINX配置：

server {
    listen 80;
    listen [::]:80;
    server_name retronexus.io www.retronexus.io;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name retronexus.io www.retronexus.io;
    client_max_body_size 64M;
    index index.php index.html;
    root /var/www/html;
    ssl_certificate /etc/letsencrypt/live/retronexus.io/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/retronexus.io/privkey.pem;
    location ~ \.php$ {
        fastcgi_pass wordpress:9000;
        include fastcgi_params;
    }
}

采取了困境步骤：

•   Verified SSL certificate setup is correct.
•   Checked NGINX logs, but no specific errors related to blocked content in the WordPress editor.
•   Confirmed permissions on /var/www/html are set to allow access from both the NGINX and WordPress containers.

NGINX设置中是否有任何可能阻止WordPress编辑器中的内容的错误配置？还是避免内容阻塞需要特定的设置？关于调试此问题或可能相关的其他设置的任何建议将不胜感激。
    

WordPress编辑器页面使用

Answer 1

与

src="blob:https://your-site.com..."

一起使用，因此您的内容被内容安全策略阻止。将这些行添加到您的NGINX配置中，将其添加到“服务器”块中：

        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'; frame-src 'self' blob:;" always;

注明指令末尾。