plugins.textpattern.com: no header graphic

Bloke · 2024-03-17 11:06:32

All sites in the suite return the Textpattern logo in the header except plugins.textpattern.com which renders nothing.

Console indicates:

Content-Security-Policy: The page's settings blocked the loading of a resource at data:image/avif;base64,AAAAIGZ0eXBhdmlmA… ("img-src"). detect.js:1:186
Content-Security-Policy: The page's settings blocked the loading of a resource at data:image/jxl;base64,/woIELASCAgQAFwASx… ("img-src"). detect.js:1:699
Content-Security-Policy: The page's settings blocked the loading of a resource at data:image/webp;base64,UklGRjoAAABXRUJQV… ("img-src"). detect.js:1:844
Content-Security-Policy: The page's settings blocked the loading of a resource at data:image/svg+xml;charset=utf-8,%3Csvg … ("img-src"). plugins.textpattern.com
Content-Security-Policy: The page's settings blocked the loading of a resource at https://textpattern.com/assets/img/com/index-plugins-showcase.png ("img-src").

bici · 2024-03-17 16:34:53

Bloke wrote #336939:

All sites in the suite return the Textpattern logo in the header except plugins.textpattern.com which renders nothing.

I pointed this out weeks ago but I failed to find the causes as you did. Thanks for the verification.

Bloke · 2024-03-17 17:02:15

Ah sorry. Didn’t see your post or I’d have jumped on that thread.

phiw13 · 2024-03-18 00:16:21

It is not limited to the header graphic. From a cursory look at the console, about everything “image” and that includes .svg images loaded in the stylesheet are blocked.

CSP header:

Content-Security-Policy: base-uri 'self';connect-src 'self';default-src 'none';font-src https://textpattern.com 'self';form-action 'self';frame-ancestors 'none';frame-src https://textpattern.com data: 'none';img-src 'self';manifest-src 'self';media-src 'self';object-src 'none';script-src https://textpattern.com 'self' 'unsafe-inline';style-src https://textpattern.com 'self' 'unsafe-inline';

Key: img-src 'self';

gaekwad · 2024-03-18 16:47:22

Feck. Leave that with me.

gaekwad · 2024-03-18 16:50:24

Bloke wrote #336939:

All sites in the suite return the Textpattern logo in the header except plugins.textpattern.com which renders nothing.

Should now be fixed. Sorry about that.

Bloke · 2024-03-18 18:08:17

Awesome, thank you so much.

Textpattern CMS

Textpattern CMS support forum

#1 2024-03-17 11:06:32