The legal pages' brand font loads: font-src allows openvibe.network (their navbar comes from there) (#278)

OP OpenVibers committed 11 days ago · 1615d432f0 · 1 file, +1 −1

Changes

ddiff --git a/server/web/home.js b/server/web/home.js
iindex 1e2084a..862e469 100644
---- a/server/web/home.js
++++ b/server/web/home.js
@@@ -36,7 +36,7 @@ const HOME_CSP = [
      // The Frame's theme-loader, navbar and footer are served from /shared; the inline boot is the shell's.
      "script-src 'self' 'unsafe-inline' https://openvibe.network https://static.cloudflareinsights.com",
      "style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
--    "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
++    "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com https://openvibe.network",
      "img-src 'self' data: https:",
      // The navbar asks the Network for the session, menus and notifications (events: realtime and release notices).
      "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com",