faral/pokerface
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Broaden CSP img-src to allow all Atlassian avatar domains
All checks were successful
Build & Push Container Image / build (push) Successful in 5s
Details

Browse source 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jan Willem Mannaerts 2026-02-28 16:40:02 +01:00
parent b25631ec40
commit 31dfbe3cca
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
backend/src/index.js
View file

@ -59,7 +59,7 @@ app.use((_req, res, next) => {
"script-src 'self'",
"style-src 'self' 'unsafe-inline'",
`connect-src 'self' wss://${isProd ? new URL(frontendUrl).host : '*'}`,
"img-src 'self' https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net https://secure.gravatar.com data:",
"img-src 'self' https://*.atl-paas.net https://*.atlassian.com https://secure.gravatar.com data:",
"font-src 'self'",
"object-src 'none'",
"base-uri 'self'",