https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832
--- Comment #16 from Paul Derscheid <[email protected]> --- Created attachment 209469 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209469&action=edit Bug 43832: (QA follow-up) Allow the archive.org redirect hop for Open Library covers Archived Open Library covers redirect covers.openlibrary.org -> archive.org -> iaNNN.us.archive.org. CSP checks every redirect hop, so without https://archive.org in img-src these covers are blocked. - add https://archive.org to the Open Library, Coce and example img-src - older covers are the redirected ones, not recent ones Test plan: 1. In /etc/koha/sites/kohadev/koha-conf.xml, set for the OPAC <csp_mode>enabled</csp_mode> and a <csp_header_value> with the Open Library sources of the previous patch: script-src https://openlibrary.org img-src https://covers.openlibrary.org https://*.us.archive.org 2. Enable OpenLibraryCovers, restart_all 3. Open /cgi-bin/koha/opac-detail.pl?biblionumber=6 (X Power Tools, served directly): the cover is displayed 4. Open /cgi-bin/koha/opac-detail.pl?biblionumber=1 (E Street shuffle, archived): no cover, the console reports: Loading the image 'https://archive.org/download/olcovers253/olcovers253-L.zip/2536391-L.jpg' violates the following Content Security Policy directive: "img-src 'self' data: https://covers.openlibrary.org https://*.us.archive.org";. The action has been blocked. 5. Apply this patch, add https://archive.org to img-src as documented, restart_all 6. Reload biblionumber=1: the cover is displayed, no CSP violation Assisted-by: Opus 5.5 (Anthropic) Signed-off-by: Paul Derscheid <[email protected]> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
