diff --git a/CHANGELOG.md b/CHANGELOG.md index c07ec0b27..a99a8f16e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,8 @@ You can also check the ## Unreleased -Nothing yet. +- Fixes + - Fixed CSP for the embed page ### 6.2.4 - 2025-11-28 diff --git a/app/next.config.js b/app/next.config.js index f80407ed3..a3695ac3d 100644 --- a/app/next.config.js +++ b/app/next.config.js @@ -68,7 +68,7 @@ module.exports = withPreconstruct( } https://*.sentry.io https://vercel.live/ https://vercel.com https://*.googletagmanager.com`, `script-src 'self' 'unsafe-inline'${ process.env.NODE_ENV === "development" ? " 'unsafe-eval'" : "" - } https://*.sentry.io https://vercel.live/ https://vercel.com https://*.googletagmanager.com https://api.mapbox.com`, + } https://*.sentry.io https://vercel.live/ https://vercel.com https://*.googletagmanager.com https://api.mapbox.com https://api.maptiler.com`, `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net`, `font-src 'self'`, `form-action 'self'`, @@ -78,8 +78,8 @@ module.exports = withPreconstruct( // * to allow loading legend images from custom WMS / WMTS endpoints and data: to allow downloading images `img-src 'self' * data: blob:`, - `script-src-elem 'self' 'unsafe-inline' https://*.admin.ch https://visualize.admin.ch https://*.visualize.admin.ch https://vercel.live https://vercel.com https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://api.mapbox.com https://cdn.jsdelivr.net`, - `worker-src 'self' blob: https://*.admin.ch`, + `script-src-elem 'self' 'unsafe-inline' https://*.admin.ch https://visualize.admin.ch https://*.visualize.admin.ch https://vercel.live https://vercel.com https://*.vercel.app https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://api.mapbox.com https://cdn.jsdelivr.net`, + `worker-src 'self' blob: https://*.admin.ch https://*.vercel.app`, ].join("; "), }); } diff --git a/app/pages/embed/[chartId].tsx b/app/pages/embed/[chartId].tsx index b3901c2e0..3deefefa7 100644 --- a/app/pages/embed/[chartId].tsx +++ b/app/pages/embed/[chartId].tsx @@ -66,7 +66,17 @@ const EmbedPage = (props: PageProps) => {