From 4ca38821fbac9cac939a0ef97890fa563805a70c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <bjoern.fromme@ep-reisen.de>
Date: Sun, 25 Oct 2026 14:53:01 +0100
Subject: [PATCH] fix: the backend may load images from cdn.ep-reisen.de

TYPO3 13 enforces a Content Security Policy in the backend whose img-src
only allows the backend's own host, data: URIs and the YouTube/Vimeo CDNs.
The frontend references its favicons on the CDN, so yoast's snippet preview
showed a broken favicon (CSP report: img-src blocked
https://cdn.ep-reisen.de/fileadmin/user_upload/favicon/ep/favicon.ico).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Configuration/ContentSecurityPolicies.php  | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 packages/ep_theme/Configuration/ContentSecurityPolicies.php

diff --git a/packages/ep_theme/Configuration/ContentSecurityPolicies.php b/packages/ep_theme/Configuration/ContentSecurityPolicies.php
new file mode 100644
index 0000000..7a4956a
--- /dev/null
+++ b/packages/ep_theme/Configuration/ContentSecurityPolicies.php
@@ -0,0 +1,18 @@
+<?php
+
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Directive;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Mutation;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationCollection;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationMode;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Scope;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\UriValue;
+use TYPO3\CMS\Core\Type\Map;
+
+// The frontend references favicons and images on the CDN, and backend previews (yoast's snippet
+// preview) show them as they are.
+return Map::fromEntries([
+    Scope::backend(),
+    new MutationCollection(
+        new Mutation(MutationMode::Extend, Directive::ImgSrc, new UriValue('https://cdn.ep-reisen.de')),
+    ),
+]);