diff --git a/satellite/console/consoleweb/server.go b/satellite/console/consoleweb/server.go index 75cccfe75..2b7166dab 100644 --- a/satellite/console/consoleweb/server.go +++ b/satellite/console/consoleweb/server.go @@ -424,10 +424,10 @@ func (server *Server) appHandler(w http.ResponseWriter, r *http.Request) { "connect-src 'self' *.tardigradeshare.io *.storjshare.io https://hcaptcha.com *.hcaptcha.com " + server.config.GatewayCredentialsRequestURL, "frame-ancestors " + server.config.FrameAncestors, "frame-src 'self' *.stripe.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://hcaptcha.com *.hcaptcha.com", - "img-src 'self' data: blob: *.tardigradeshare.io *.storjshare.io", + "img-src 'self' data: blob: *.tardigradeshare.io *.storjshare.io *.storjsatelliteshare.io", // Those are hashes of charts custom tooltip inline styles. They have to be updated if styles are updated. "style-src 'unsafe-hashes' 'sha256-7mY2NKmZ4PuyjGUa4FYC5u36SxXdoUM/zxrlr3BEToo=' 'sha256-PRTMwLUW5ce9tdiUrVCGKqj6wPeuOwGogb1pmyuXhgI=' 'sha256-kwpt3lQZ21rs4cld7/uEm9qI5yAbjYzx+9FGm/XmwNU=' 'sha256-Qf4xqtNKtDLwxce6HLtD5Y6BWpOeR7TnDpNSo+Bhb3s=' 'self' https://hcaptcha.com *.hcaptcha.com", - "media-src 'self' blob: *.tardigradeshare.io *.storjshare.io", + "media-src 'self' blob: *.tardigradeshare.io *.storjshare.io *.storjsatelliteshare.io", } header.Set("Content-Security-Policy", strings.Join(cspValues, "; "))