Changeset 3401:47b013a91ab9 for inc/admin

Timestamp:

11/10/16 15:32:24 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Add blob: to CSP img-src default directive, closes #2218

File:

• inc/admin/lib.dc.page.php (modified) (1 diff)

inc/admin/lib.dc.page.php

@@ -109 +109 @@
                $csp['script-src'] = $core->blog->settings->system->csp_admin_script ?: "'self' 'unsafe-inline' 'unsafe-eval'";
                $csp['style-src'] = $core->blog->settings->system->csp_admin_style ?: "'self' 'unsafe-inline'";
-               $csp['img-src'] = $core->blog->settings->system->csp_admin_img ?: "'self' data: media.dotaddict.org";
+               $csp['img-src'] = $core->blog->settings->system->csp_admin_img ?: "'self' data: media.dotaddict.org blob:";
 
                # Cope with blog post preview (via public URL in iframe)