From 239b9f3074936652b808b4bf0714ddea85507130 Mon Sep 17 00:00:00 2001
From: Timmy Willison <timmywil@users.noreply.github.com>
Date: Sat, 14 Dec 2024 17:47:56 -0500
Subject: [PATCH] api.jquery.com: add CSP exception for flickr for
 /jQuery.getJSON

Ref https://github.com/jquery/infrastructure-puppet/issues/54
Closes gh-474
---
 themes/api.jquery.com/functions.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/themes/api.jquery.com/functions.php b/themes/api.jquery.com/functions.php
index e95f4365..1a47f39a 100644
--- a/themes/api.jquery.com/functions.php
+++ b/themes/api.jquery.com/functions.php
@@ -1,8 +1,10 @@
 <?php
 
 // Allow inline scripts and styles in API demos
+// Allow flickr script and images on https://api.jquery.com/jQuery.getJSON/
 add_filter( 'jq_content_security_policy', function ( $policy ) {
-	$policy[ 'script-src' ] = "'self' 'unsafe-inline' code.jquery.com";
+	$policy[ 'script-src' ] = "'self' 'unsafe-inline' code.jquery.com api.flickr.com";
 	$policy[ 'style-src' ] = "'self' 'unsafe-inline' code.jquery.com";
+	$policy[ 'img-src' ] = "'self' data: code.jquery.com live.staticflickr.com";
 	return $policy;
 } );