From b4b955efc8d9605e9f6d9e5444e54744e903bf7e Mon Sep 17 00:00:00 2001 From: kermieisinthehouse Date: Mon, 13 Dec 2021 23:13:23 +0000 Subject: [PATCH] Fix images loading from stashdb (#2115) * Allow images from any source Co-authored-by: WithoutPants <53250216+WithoutPants@users.noreply.github.com> --- pkg/api/server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/api/server.go b/pkg/api/server.go index 154ffa644..1dbd49585 100644 --- a/pkg/api/server.go +++ b/pkg/api/server.go @@ -352,7 +352,7 @@ func SecurityHeadersMiddleware(next http.Handler) http.Handler { } connectableOrigins += "; " - cspDirectives := "default-src data: 'self' 'unsafe-inline';" + connectableOrigins + "script-src 'self' 'unsafe-inline'; child-src 'none'; object-src 'none'; form-action 'self'" + cspDirectives := "default-src data: 'self' 'unsafe-inline';" + connectableOrigins + "img-src data: *; script-src 'self' 'unsafe-inline'; child-src 'none'; object-src 'none'; form-action 'self'" w.Header().Set("Referrer-Policy", "same-origin") w.Header().Set("X-Content-Type-Options", "nosniff")