marty/rm-circle-team-router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PolHunter embed on /training, CSP allows polhunter.com

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
martbost
2026-09-19 14:12:25 -05:00
parent 9ad864c0ba
commit c6e6acbdc5
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server.js
+1 -1
View File
@@ -578,7 +578,7 @@ async function handleTranslate(req,res){
// frame-src includes 'self' so our own pages (the Page Builder preview framing
// a member's /p/<id> page) are not blocked by our own policy.
const CSP_BASE="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com";
const CSP_BASE="default-src 'self'; script-src 'self' https://polhunter.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self' https://polhunter.com; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com"; // polhunter.com: the PolHunter embed on /training (2026-09-19)
function securityHeaders(extra={}) {
// Public pages must render inside safelist / traffic-exchange iframes, so framing stays open here; admin.html re-locks it via ADMIN_FRAME_HEADERS.
return {