Changeset c869272 in Klonkt

Timestamp:

06/14/2026 06:16:58 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

5e95aac

Parents:

8afbdd6

Message:

fix: allow inline event handlers (CSP) — avatar upload + role dropdown were not working

Helmet's default set script-src-attr to 'none', blocking ALL inline event
handlers. As a result, <input onchange="this.form.submit()"> on the avatar
upload (and the role <select>) did nothing: choosing a file did not fire a
submit. Now script-src-attr 'unsafe-inline', consistent with the already
permitted inline <script> (script-src 'unsafe-inline').

Co-Authored-By: Claude <noreply@…>

File:

• src/server.js (modified) (1 diff)

src/server.js

@@ -66 +66 @@
       defaultSrc: ["'self'"],
       scriptSrc: ["'self'", "'unsafe-inline'"],
+      // Helmet's default zet script-src-attr op 'none', wat ALLE inline event-
+      // handlers (onchange/onclick/onsubmit) blokkeert — daardoor deed o.a. de
+      // avatar-upload (<input onchange="this.form.submit()">) en de rol-dropdown
+      // niets. We staan inline handlers expliciet toe, consistent met de al
+      // toegestane inline <script> hierboven.
+      scriptSrcAttr: ["'unsafe-inline'"],
       styleSrc: ["'self'", "'unsafe-inline'"],
       imgSrc: ["'self'", "data:", "https:"],