functions: allow loading styles and images from the jQuery CDN

Ref jquery/infrastructure-puppet#54 Closes gh-471
jquery · Oct 16, 2024 · 1eaa3fd · 1eaa3fd
1 parent 7273897
commit 1eaa3fd
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 5 deletions.
diff --git a/themes/api.jquery.com/functions.php b/themes/api.jquery.com/functions.php
@@ -3,6 +3,6 @@
 // Allow inline scripts and styles in API demos
 add_filter( 'jq_content_security_policy', function ( $policy ) {
 	$policy[ 'script-src' ] = "'self' 'unsafe-inline' code.jquery.com";
-	$policy[ 'style-src' ] = "'self' 'unsafe-inline'";
+	$policy[ 'style-src' ] = "'self' 'unsafe-inline' code.jquery.com";
 	return $policy;
 } );
diff --git a/themes/api.jquerymobile.com/functions.php b/themes/api.jquerymobile.com/functions.php
@@ -32,6 +32,6 @@ function jq_mobile_api_version_current() {
 // Allow inline scripts and styles in API demos
 add_filter( 'jq_content_security_policy', function ( $policy ) {
 	$policy[ 'script-src' ] = "'self' 'unsafe-inline' code.jquery.com";
-	$policy[ 'style-src' ] = "'self' 'unsafe-inline'";
+	$policy[ 'style-src' ] = "'self' 'unsafe-inline' code.jquery.com";
 	return $policy;
 } );
diff --git a/themes/api.jqueryui.com/functions.php b/themes/api.jqueryui.com/functions.php
@@ -28,6 +28,6 @@ function jq_ui_api_version_current() {
 // Allow inline scripts and styles in API demos
 add_filter( 'jq_content_security_policy', function ( $policy ) {
 	$policy[ 'script-src' ] = "'self' 'unsafe-inline' code.jquery.com";
-	$policy[ 'style-src' ] = "'self' 'unsafe-inline'";
+	$policy[ 'style-src' ] = "'self' 'unsafe-inline' code.jquery.com";
 	return $policy;
 } );
diff --git a/themes/jquery/functions.php b/themes/jquery/functions.php
@@ -265,9 +265,9 @@ function jq_content_security_policy() {
 		'default-src' => "'self'",
 		'script-src' => "'self' 'nonce-$nonce' code.jquery.com",
 		// The nonce is here so inline scripts can be used in the theme
-		'style-src' => "'self' 'nonce-$nonce'",
+		'style-src' => "'self' 'nonce-$nonce' code.jquery.com",
 		// data: SVG images are used in typesense
-		'img-src' => "'self' data:",
+		'img-src' => "'self' data: code.jquery.com",
 		'connect-src' => "'self' typesense.jquery.com",
 		'font-src' => "'self'",
 		'object-src' => "'none'",