From b414d9196417872d5bca443fee09d0a6e6c9efb0 Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Tue, 2 Nov 2021 18:55:56 +0400 Subject: [PATCH] Fix for #2162 (Epub viewer isn't displaying images) --- cps/web.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cps/web.py b/cps/web.py index 47b3b49b..8d3e4551 100644 --- a/cps/web.py +++ b/cps/web.py @@ -85,6 +85,8 @@ def add_security_headers(resp): resp.headers['Content-Security-Policy'] = "default-src 'self'" + ''.join([' '+host for host in config.config_trustedhosts.strip().split(',')]) + " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:" if request.endpoint == "editbook.edit_book" or config.config_use_google_drive: resp.headers['Content-Security-Policy'] += " *" + elif request.endpoint == "web.read_book": + resp.headers['Content-Security-Policy'] += " blob:;style-src-elem 'self' blob: 'unsafe-inline';" resp.headers['X-Content-Type-Options'] = 'nosniff' resp.headers['X-Frame-Options'] = 'SAMEORIGIN' resp.headers['X-XSS-Protection'] = '1; mode=block'