AllBugsFeaturesChangelogSearchNew post
Sign in with Fluxer
Features

Allow more image hosts in the custom CSS content security policy

(#909) Feature Under consideration theming
by RexSystem edited originally by @icicle1133 on GitHub

Problem

Custom css backgrounds

Proposed solution

Allow the .webp format to be used, right now im trying to use: https://i.giphy.com/PLJeLzh6gfL2LhUIW0.webp and since csp blocks that url, i upload it to a community i make, but then its no longer animated EDIT: Also possibly allow github urls (e.g. raw.githubusercontent.com, *.github.io, github.com, etc)

13 comments

Sign in with Fluxer to comment and vote.
Comment by @nesges
RexSystem 1 vote originally by @nesges on GitHub 3 replies
I get that it's inconvinient, but CSP is way to important to deactivate it for arbitrary websites, not in control of fluxer
Permalink
Comment by @icicle1133
RexSystem 1 vote originally by @icicle1133 on GitHub OP
I get that it's inconvinient, but CSP is way to important to deactivate it for arbitrary websites, not in control of fluxer
i never said anything about deactivating. i simply said add urls to be allowed.
Permalink
Comment by @zulc22
RexSystem 1 vote originally by @zulc22 on GitHub
What if there were uploads/assets associated with themes? Allowing the user to add their own CSP domains is a very band-aid fix. Current solutions are to either convert everything to data: URIs or upload your files to Fluxer itself via a dump server or Personal Notes, as the CSP policy allows the uploaded-files server.
Permalink
Comment by @retcinder
RexSystem 1 vote originally by @retcinder on GitHub
What if there were uploads/assets associated with themes? Allowing the user to add their own CSP domains is a very band-aid fix. Current solutions are to either convert everything to data: URIs or upload your files to Fluxer itself via a dump server or Personal Notes, as the CSP policy allows the uploaded-files server.
This does sound like an interesting solution but I personally think CSP domain adding would be better.
Permalink
Comment by @retcinder
RexSystem 1 vote originally by @retcinder on GitHub 8 replies
This would be really handy. I personally would need codeberg to be accessible (as it wouldn't be feasible for 20+ images to be loaded from saved media). Given that it would be a security issue to enable it globally on specific sites, perhaps it can be a GUI popup on a per git-repository/base-url basis? (So, prompt to enable it on exampledomain/foo/bar-theme, allowing any file to be loaded from a URL matching that description IF THE USER AUTHORISES IT)
Permalink
Comment by @icicle1133
RexSystem 1 vote originally by @icicle1133 on GitHub OP
This would be really handy. I personally would need codeberg to be accessible (as it wouldn't be feasible for 20+ images to be loaded from saved media). Given that it would be a security issue to enable it globally on specific sites, perhaps it can be a GUI popup on a per git-repository/base-url basis? (So, prompt to enable it on exampledomain/foo/bar-theme, allowing any file to be loaded from a URL matching that description IF THE USER AUTHORISES IT)
i thought about doing this and making a pull request
Permalink
Comment by @icicle1133
RexSystem 1 vote edited originally by @icicle1133 on GitHub OP
@tulpenkiste image image it works so far, however most themes for betterdiscord/vencord still need rewritten EDIT: I did NOT remove anything to do with CSP, i added github urls and some giphy urls
  • 555031156-c2602500-fee7-4ffe-9e5e-7be1a7d791b1.png

    555031156-c2602500-fee7-4ffe-9e5e-7be1a7d791b1.png

    565×506 | 43 kB

  • 555031241-1cd80ab2-46a2-4477-abfb-ebf085e6630f.png

    555031241-1cd80ab2-46a2-4477-abfb-ebf085e6630f.png

    1404×881 | 128 kB

Permalink
Comment by @retcinder
RexSystem 1 vote originally by @retcinder on GitHub
Oooo, very nice. Hoping you do end up making a PR for it (with codeberg URL support) :3
Permalink
Comment by @icicle1133
RexSystem 1 vote edited originally by @icicle1133 on GitHub OP
Oooo, very nice. Hoping you do end up making a PR for it (with codeberg URL support) :3
unfortunately: image edit: @tulpenkiste i dont know what codeberg is so please reply with some urls for it and i will add it in!
  • 555097591-08273aab-3fca-4673-97f3-f30626f5ae11.png

    555097591-08273aab-3fca-4673-97f3-f30626f5ae11.png

    1035×109 | 8 kB

Permalink
Comment by @retcinder
RexSystem 1 vote edited originally by @retcinder on GitHub
edit: @tulpenkiste i dont know what codeberg is so please reply with some urls for it and i will add it in!
Codeberg is another site for hosting git repositories, I use it for all of my personal projects. You can find more information about it at here.
Permalink
Comment by @icicle1133
RexSystem 1 vote edited originally by @icicle1133 on GitHub OP
> edit: @tulpenkiste i dont know what codeberg is so please reply with some urls for it and i will add it in! Codeberg is another site for hosting git repositories, I use it for all of my personal projects. You can find more information about it at here.
https://github.com/fluxerapp/fluxer/commit/5bd02d2ac796ac88598959386f29a82de074edb0 here are my changes with codeberg support, if only i could make a pr 😢
Permalink
Comment by @retcinder
RexSystem 1 vote originally by @retcinder on GitHub
I think you forgot to add the codeberg URLs, I only see github there
Permalink
Comment by @retcinder
RexSystem 1 vote originally by @retcinder on GitHub
You would only need to add https://codeberg.org and maybe https://*.codeberg.page though, so easy fix
Permalink