Sabo/webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(csp): allow external https images in img-src — closes #608

Browse Source 
Co-authored-by: Hermes Agent <agent@hermes>
This commit is contained in:
nesquena-hermes
2026-04-16 23:34:21 -07:00
committed by GitHub
parent d6267f4d31
commit f3f23abd4e
3 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api/helpers.py
View File

@@ -45,7 +45,7 @@ def _security_headers(handler):
"default-src 'self'; "
"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
"style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
"img-src 'self' data:; font-src 'self' data: https://cdn.jsdelivr.net; connect-src 'self'; "
"img-src 'self' data: https: blob:; font-src 'self' data: https://cdn.jsdelivr.net; connect-src 'self'; "
"base-uri 'self'; form-action 'self'"
)
handler.send_header(