Changeset 9effb80 in Klonkt for src/server.js

Timestamp:

06/21/2026 04:37:18 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

421c2d4

Parents:

015ce46

Message:

fix(editor): CSP blocked blob: image → empty edit dialog

img-src was missing blob:, so the Cropper <img> (URL.createObjectURL → blob:)
was silently blocked by CSP → no image visible. Added blob: to img-src (media-src
already had it for audio). + onerror fallback in the editor: if the image fails
to load, the original is uploaded instead of getting stuck.

Co-Authored-By: Claude <noreply@…>

File:

• src/server.js (modified) (1 diff)

src/server.js

@@ -105 +105 @@
       scriptSrcAttr: ["'unsafe-inline'"],
       styleSrc: ["'self'", "'unsafe-inline'"],
-      imgSrc: ["'self'", "data:", "https:"],
+      // blob: nodig voor de afbeeldings-editor (Cropper) — die toont de gekozen
+      // foto via een URL.createObjectURL(blob:…). Zonder blob: blokkeert de CSP
+      // de <img> stil → leeg bewerk-venster. (media-src heeft blob: al voor audio.)
+      imgSrc: ["'self'", "data:", "https:", "blob:"],
       connectSrc: ["'self'", "wss:", "ws:", "https://*.spotifycdn.com", "https://*.scdn.co"],
       // blob: is required for the audio player — it fetch()es track bytes and