[BUGFIX] Allow CSP inline styles in directly requested SVG files
Using CSP directive `style-src 'unsafe-inline'` seems to be fine for directly requested SVG files, since corresponding definitions are bound to the corresponding resource. Loading styles from any other external resource is still denied. Resolves: #93884 Releases: main, 11.5, 10.4 Change-Id: Ifddf8782ecaa81bf26026ae8850d8c53b7977bd7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77456 Reviewed-by:Oliver Hader <oliver.hader@typo3.org> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Hader <oliver.hader@typo3.org>
Showing
- typo3/sysext/core/Classes/Controller/FileDumpController.php 7 additions, 3 deletionstypo3/sysext/core/Classes/Controller/FileDumpController.php
- typo3/sysext/install/Resources/Private/FolderStructureTemplateFiles/resources-root-htaccess 5 additions, 1 deletion...vate/FolderStructureTemplateFiles/resources-root-htaccess
Please register or sign in to comment