Changeset 9effb80 in Klonkt

Timestamp:

06/21/2026 04:37:18 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

421c2d4

Parents:

015ce46

Message:

fix(editor): CSP blocked blob: image → empty edit dialog

img-src was missing blob:, so the Cropper <img> (URL.createObjectURL → blob:)
was silently blocked by CSP → no image visible. Added blob: to img-src (media-src
already had it for audio). + onerror fallback in the editor: if the image fails
to load, the original is uploaded instead of getting stuck.

Co-Authored-By: Claude <noreply@…>

Location:

src

Files:

• server.js (modified) (1 diff)
• views/pages/post-edit.ejs (modified) (1 diff)

src/server.js

@@ -105 +105 @@
       scriptSrcAttr: ["'unsafe-inline'"],
       styleSrc: ["'self'", "'unsafe-inline'"],
-      imgSrc: ["'self'", "data:", "https:"],
+      // blob: nodig voor de afbeeldings-editor (Cropper) — die toont de gekozen
+      // foto via een URL.createObjectURL(blob:…). Zonder blob: blokkeert de CSP
+      // de <img> stil → leeg bewerk-venster. (media-src heeft blob: al voor audio.)
+      imgSrc: ["'self'", "data:", "https:", "blob:"],
       connectSrc: ["'self'", "wss:", "ws:", "https://*.spotifycdn.com", "https://*.scdn.co"],
       // blob: is required for the audio player — it fetch()es track bytes and

src/views/pages/post-edit.ejs

@@ -1102 +1102 @@
         cropper = new Cropper(img, { viewMode: 1, autoCropArea: 1, background: false, responsive: true });
       };
+      img.onerror = () => { cleanup(); resolve(file); }; // kon niet laden → upload het origineel
       img.src = url;