EP/typo3-13
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: the backend may load images from cdn.ep-reisen.de

Browse Source 
TYPO3 13 enforces a Content Security Policy in the backend whose img-src
only allows the backend's own host, data: URIs and the YouTube/Vimeo CDNs.
The frontend references its favicons on the CDN, so yoast's snippet preview
showed a broken favicon (CSP report: img-src blocked
https://cdn.ep-reisen.de/fileadmin/user_upload/favicon/ep/favicon.ico).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
frommeandClaude Opus 5.5 committed 2026-10-25 14:53:01 +01:00
1 parent b39f17886f
commit 4ca38821fb
1 file changed
+18
Download Patch File Download Diff File Expand all files Collapse all files
packages/ep_theme/Configuration/ContentSecurityPolicies.php
+18
View File
@@ -0,0 +1,18 @@
<?php
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Directive;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Mutation;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationCollection;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationMode;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Scope;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\UriValue;
use TYPO3\CMS\Core\Type\Map;
// The frontend references favicons and images on the CDN, and backend previews (yoast's snippet
// preview) show them as they are.
return Map::fromEntries([
Scope::backend(),
new MutationCollection(
new Mutation(MutationMode::Extend, Directive::ImgSrc, new UriValue('https://cdn.ep-reisen.de')),
),
]);