From f04c1c18c1b084a71a924be4c52f3939c32f5beb Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Wed, 13 Nov 2024 15:36:25 -0800 Subject: [PATCH] apache: Relax content security policy to allow data: URL - Needed for many inline SVG images included by Bootstrap 5 using data: URLs. Signed-off-by: Sunil Mohan Adapa Reviewed-by: Veiko Aasa --- data/etc/apache2/conf-available/freedombox.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/etc/apache2/conf-available/freedombox.conf b/data/etc/apache2/conf-available/freedombox.conf index 48fc827e3..dfbd73cfd 100644 --- a/data/etc/apache2/conf-available/freedombox.conf +++ b/data/etc/apache2/conf-available/freedombox.conf @@ -83,7 +83,7 @@ RedirectMatch "^/$" "/plinth" ## Header set Referrer-Policy 'same-origin' - Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox allow-forms allow-same-origin allow-downloads; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" + Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self' data:; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox allow-forms allow-same-origin allow-downloads; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" Header set X-Content-Type-Options 'nosniff'