openvibers/openvibe.run Commits

The legal pages' brand font loads: font-src allows openvibe.network (their navbar comes from there) (#156)

OP OpenVibers committed 11 days ago · 4eaf5df67a · 1 file, +1 −1

Changes

ddiff --git a/server/web/home.js b/server/web/home.js
iindex 876690d..0281b95 100644
---- a/server/web/home.js
++++ b/server/web/home.js
@@@ -31,7 +31,7 @@ const HOME_CSP = [
      // The Frame's theme-loader, navbar and footer are served from /shared; the inline boot is the shell's.
      "script-src 'self' 'unsafe-inline' https://openvibe.network https://static.cloudflareinsights.com",
      "style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
--    "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
++    "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com https://openvibe.network",
      "img-src 'self' data: https:",
      // The navbar asks the Network for the session, menus and notifications.
      "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com",