github-such-software/wownerogue
1
0
Fork 0
mirror of https://github.com/Such-Software/wownerogue.git synced 2026-10-17 22:31:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: render visible animated 3d tavern avatars

Browse Source
This commit is contained in:
jwinterm
2026-07-06 04:11:43 -04:00
parent cb9efbe66c
commit 1ca18dfdbc
2 changed files with 65 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/index.js
+4 -3
View File
@@ -66,15 +66,16 @@ const socketHandlers = new SocketHandlers(io, activeGames, broadcastManager, deb
// CSP locks down where scripts/styles/connections may come from. Inline scripts/styles
// are still permitted ('unsafe-inline') because the current pages rely on them heavily;
// removing that is tracked as Phase 4.4 (nonce-based CSP). connect-src 'self' covers
// same-origin Socket.IO websockets under CSP Level 3.
// same-origin Socket.IO websockets under CSP Level 3. blob: is limited to render-kit
// GLB texture decoding; GLTFLoader turns embedded textures into blob URLs.
app.use((req, res, next) => {
res.setHeader('Content-Security-Policy', [
"default-src 'self'",
"script-src 'self' 'unsafe-inline' https://cdn.socket.io https://cdn.jsdelivr.net",
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data:",
"img-src 'self' data: blob:",
"font-src 'self'",
"connect-src 'self' https://smirk.cash https://cdn.socket.io https://cdn.jsdelivr.net",
"connect-src 'self' blob: https://smirk.cash https://cdn.socket.io https://cdn.jsdelivr.net",
"object-src 'none'",
"base-uri 'self'",
"frame-ancestors 'self'",