From a7c5d2d9b2bf38f12fe8b77e6a19ccc7e9265b04 Mon Sep 17 00:00:00 2001 From: Noah Lancien Date: Thu, 8 Aug 2024 15:23:42 +0200 Subject: [PATCH] fix: Added 'https://cdn.jsdelivr.net' to style-src csp --- app/Http/Middleware/SecureHeaders.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app/Http/Middleware/SecureHeaders.php b/app/Http/Middleware/SecureHeaders.php index 3a34c8c..f883343 100644 --- a/app/Http/Middleware/SecureHeaders.php +++ b/app/Http/Middleware/SecureHeaders.php @@ -54,7 +54,11 @@ class SecureHeaders // "font-src 'self' data:;", // ! Using CKEditor will must have unsafe-inline style // phpcs:ignore Generic.Files.LineLength.TooLong - "style-src 'self' 'unsafe-inline';", + 'style-src ' . implode(" ", [ + '\'self\'', + '\'unsafe-inline\'', + 'https://cdn.jsdelivr.net', + ]) . ';', // ! If you dont use ckeditor use this // "style-src 'self' 'nonce-$nonce';", // phpcs:ignore Generic.Files.LineLength.TooLong