Allow unsafe-inline styling on SVG images in docs
authorMagnus Hagander <magnus@hagander.net>
Tue, 21 Feb 2023 21:03:24 +0000 (22:03 +0100)
committerMagnus Hagander <magnus@hagander.net>
Tue, 21 Feb 2023 21:03:24 +0000 (22:03 +0100)
We already allow it on the docs pages themselves, but not on images
served up. Seems it can't get worse, and hopefully this fixes the
reported issues.

Reported by: Peter Geoghegan

pgweb/docs/views.py

index 573be6a791dfa44ed3bb9ae0222873e834f09315..e79d8900e4078346ae663aca4f3ae3f0646c92f6 100644 (file)
@@ -174,6 +174,7 @@ def docpage(request, version, filename):
 
 
 @allow_frames
+@content_sources('style', "'unsafe-inline'")
 def docsvg(request, version, filename):
     if version == 'current':
         ver = Version.objects.filter(current=True)[0].tree