cluxter opened a new issue #42: [Fauxton] Can't view the attachments because of CSP URL: https://github.com/apache/couchdb-docker/issues/42 ### _In Fauxton using the Docker image 2.1.1 of CouchDB (latest)_: ## Expected Behavior Selecting a document which has an attachment then clicking on "View Attachments" should display the attachment. ## Current Behavior Clicking on "View Attachments" doesn't do anything. Apparently the browser blocks some content because of some CSP violation. ## Possible Solution ### Default configuration The `csp` section exists and has an option `enable` set to `true`. ### Configuration test 1 In `csp`, I set the `enable` option to `false`. It didn't work. I then reset the option back to `true`. ### Configuration test 2 In `csp`, I added an option called `header_value` with its value set to `default-src 'self'; img-src *; font-src *;` as suggested here: http://docs.couchdb.org/en/2.1.1/config/misc.html#content-security-policy It didn't work. ## Steps to Reproduce (for bugs) ### With default configuration 1. Make sure the `csp` section exists in the CouchDB configuration and that it has *only one* option called `enable` set to `true`. This is apparently the default configuration. 1. Log into Fauxton as `admin` 1. Create a database 1. In the freshly created database, create a document 1. In the freshly created document, upload an attachment (for example: a .jpg file) 1. After havin uploaded the attachment, click on `View Attachments`. Nothing happens and the console doesn't say anything 1. Log out and close the window 1. Open a new tab in the browser, log into Fauxton as `admin`, open the database you created previously then the document with the attachment. At this moment the Firefox console displays an error: ```Content Security Policy: The page's settings blocked the loading of a resource at blob:http://127.0.0.1:5984/8cd22b81-323e-4d36-8d75-468e6927e490 (? default-src http://127.0.0.1:5984 ?).```. The Chrome console displays something similar: ```vendor.884175873da25bb4e526.js:40 Refused to create a worker from 'blob:http://127.0.0.1:5984/10c966f5-05a0-4a8d-9efa-66413612dce4' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.```. 1. Clicking on `View Attachments` won't do anything. ### With configuration test 2 Following the same steps than above but with the `header_value` option set as in `Configuration test 2` makes things even worse, since the content of the document won't even be displayed anymore in the text editor when you open the document (at least when using Chome). ## Your Environment <!--- Include as many relevant details about the environment you experienced the bug in --> * Version used: Docker image tagged `2.1.1` (AKA `latest`) * Browser Name and version: Firefox 57.0 64 bits + Chrome 62.0.3202.94 (both in Linux and Windows) * Operating System and version: desktop ArchLinux up-to-date, desktop Windows 7 up-to-date
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
