The duplicated 'self' does not really hurt, but you're right it should not be there.

Problem was introduced when line 230 was added (see 0025465 for details).

I believe that the correct fix is to remove 'self' from line 230, and just add data::

                http_csp_add( 'img-src', "'self'" );
-               http_csp_add( 'img-src', "'self' data:" );
+               http_csp_add( 'img-src', "data:" );

This requires testing to ensure that Dropzone preview still works after the change.

I made the suggested changes on the instance I manage and the dropzone works without problems.

image.png (23,770 bytes)   

image.png (23,770 bytes)   

Yep I ran the same test too. Thanks for the feedback.