Joplin
/
joplin
mirror of https://github.com/laurent22/joplin.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix loading data-url images, remote images

pull/12106/head
Henry Heino 2025-04-14 10:23:00 -07:00
parent 21c91e73a5
commit ba95580019
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
packages/app-desktop/gui/NoteEditor/NoteBody/TinyMCE/TinyMCE.tsx
View File

@ -731,14 +731,17 @@ const TinyMCE = (props: NoteBodyEditorProps, ref: any) => {
localization_function: _,
// See https://www.tiny.cloud/docs/tinymce/latest/tinymce-and-csp/#content_security_policy
content_security_policy: Setting.value('featureFlag.richText.useStrictContentSecurityPolicy') ? [
'default-src \'self\'',
// Media: *: Allow users to include images and videos from the internet (e.g. ![](http://example.com/image.png)).
// Media: blob: Allow loading images/videos/audio from blob URLs (for plugins)
// Media: data: Allow loading images and other media from data: URLs
'default-src \'self\' blob: data: *',
'frame-src \'none\'', // Should not contain sub-frames
'worker-src \'none\'', // Should not need web workers
'script-src \'self\'',
// Styles: unsafe-inline: TinyMCE uses inline style="" styles.
// Styles: *: Allow users to include styles from the internet (e.g. <style src="https://example.com/style.css">)
'style-src \'self\' \'unsafe-inline\' *',
// Media: *: Allow users to include images and videos from the internet (e.g. ![](http://example.com/image.png)).
'media-src \'self\' *',
'style-src \'self\' \'unsafe-inline\' * data:',
].join(' ; ') : undefined,
contextmenu: false,
browser_spellcheck: true,