0

I have Content Security Policy added to my WordPress site via Header set in .htaccess, and just found if I am on the WordPress plugins admin page (/wp-admin/plugins.php), and click "View Details" for any given plugin, its images in its popup are blocked. They come from an all external domains, none of which are allowed in my CSP (although it's possible there could be some overlap from another item or site function, but most if not all are not).

Do I have to add the url to img-src in my CSP for every plugin's "View Details" popup window, or is there a way to use CSP to say "images from any now or future installed plugin's view details window are allowed to load"? I am assuming I have to add each manually, and add new ones if a new plugin is installed - but wanted to check around from others first!

Also - if I should have asked this in one of the other Stack forums, please let me know!

ThanksScreenshot showing this and console errors

Improve this question
6
  • I think Stack Overflow is probably the better place, so I posted this there also. There I could use the tag content-security-policy whereas here, the tag does not exist. Here is the same question posted on Stack Overflow.
    – Ben Blue
    Jun 26 at 19:19
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – nmr
    Jun 27 at 8:01
  • You only need to add the domain, so just allow images from ps.w.org and any plugins hosted on wordpress.org should be fine.
    – Jacob Peattie
    Jun 27 at 9:07
  • tag creation is something that comes when you have higher reputation, and you'll need to include what you did to your HTAccess for an answer to be possible. It's also very possible that what you want to do is fundamentally incompatible with underscores templating making it impossible without crippling Yoast SEO and the media library, but I can only guess at the changes you made to CSP. Note that CSP is one of the few ways you can permanently make a domain name unusable for websites if you mess up badly enough
    – Tom J Nowell ♦
    Jun 27 at 15:24
  • Also this isn't a forum!! I converted your "solution" into a comment, the answer box is for answers/solutions, they aren't replies like a forum and they move as people vote up and down
    – Tom J Nowell ♦
    Jun 27 at 15:25

1 Answer 1

Reset to default
1

The answer, as mentioned in a comment by @JacobPeattie, was to add the domains to my .htaccess file where I am setting the CSP Headers, (turns out most plugins' "View Details" link loads images from ps.w.org, which I just learned). A few other plugins loaded images from other domains, so I also added each of those domain(s) to my .htaccess as well. This looks like:

Header set Content-Security-Policy: img-src 'self' https://ps.w.org/ https://updates.theme-fusion.com/wp-content/uploads/

And so on (I didn't list all the other domains, just one to show as example. Now all the plugins' "View Details" images load without error as they are listed in the CSP.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.