Allow inline style elements for event-admin CSP

2026-01-24 21:02:33 +01:00
parent 71604c6e41
commit 7a91e40bb3
1 changed files with 5 additions and 0 deletions
--- a/app/Http/Middleware/ContentSecurityPolicy.php
+++ b/app/Http/Middleware/ContentSecurityPolicy.php
@@ -33,6 +33,8 @@ class ContentSecurityPolicy
            return $response;
        }

+        $allowUnsafeInlineStyles = $request->is('event-admin*');
+
        $matomoOrigin = $this->normaliseOrigin(config('services.matomo.url'));
        $scriptSources = [
            "'self'",
@@ -46,6 +48,9 @@ class ContentSecurityPolicy
            "'nonce-{$styleNonce}'",
            'https:',
        ];
+        if ($allowUnsafeInlineStyles) {
+            $styleSources[] = "'unsafe-inline'";
+        }

        $connectSources = [
            "'self'",