diff --git a/src/server.js b/src/server.js index 1522f77a..beed5d34 100644 --- a/src/server.js +++ b/src/server.js @@ -217,11 +217,13 @@ function index(req, res, next) { ]; // If prefetch is enabled, but storage is not, we have to allow mixed content + // - https://user-images.githubusercontent.com is where we currently push our changelog screenshots + // - data: is required for the HTML5 video player if (Helper.config.prefetchStorage || !Helper.config.prefetch) { - policies.push("img-src 'self' https://user-images.githubusercontent.com"); + policies.push("img-src 'self' data: https://user-images.githubusercontent.com"); policies.unshift("block-all-mixed-content"); } else { - policies.push("img-src http: https:"); + policies.push("img-src http: https: data:"); } res.setHeader("Content-Type", "text/html");