Re: Inline images not working
Posted: 05 Sep 2024, 18:25
These may be relevant:
MantisBT Formatting 2.26.1
MarkDown Editor 0.3
MantisBT Formatting 2.26.1
MarkDown Editor 0.3
For example you will need to create a mini-plugin with the next set of sufficient methods:acoder2020 wrote:Wait, discovered the problem:
Refused to load the image 'https://example.com/blahlbhalbh.jpg' because it violates the following Content Security Policy directive: "img-src 'self' 'self' data:".
Code: Select all
function hooks() {
return [ 'EVENT_CORE_HEADERS' => 'csp_headers' ]
}
function csp_headers() {
http_csp_add( 'img-src', 'https://example.com/' );
}
Code: Select all
Refused to load the image 'https://external-domain.com/path/image.jpg' because it violates the following Content Security Policy directive: "img-src 'self' data:".Code: Select all
// Add to config_inc.php
$g_custom_headers = array(
'Content-Security-Policy: default-src \'self\'; img-src \'self\' data: https://your-domain.com; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\'; style-src \'self\' \'unsafe-inline\'; frame-ancestors \'self\';'
);
Code: Select all
// Add to config_inc.php
$g_custom_headers = array(
'Content-Security-Policy: default-src \'self\'; img-src \'self\' data: https://domain1.com https://domain2.com; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\'; style-src \'self\' \'unsafe-inline\'; frame-ancestors \'self\';'
);
Code: Select all
// Add to config_inc.php
$g_custom_headers = array(
'Content-Security-Policy: default-src \'self\'; img-src * data:; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\'; style-src \'self\' \'unsafe-inline\'; frame-ancestors \'self\';'
);