I have Content Security Policy added to my WordPress site via Header set
in .htaccess
, and just found if I am on the WordPress plugins admin page (/wp-admin/plugins.php), and click "View Details" for any given plugin, its images in its popup are blocked. They come from an all external domains, none of which are allowed in my CSP (although it's possible there could be some overlap from another item or site function, but most if not all are not).
Do I have to add the url
to img-src
in my CSP for every plugin's "View Details" popup window, or is there a way to use CSP to say "images from any now or future installed plugin's view details window are allowed to load"? I am assuming I have to add each manually, and add new ones if a new plugin is installed - but wanted to check around from others first!
Also - if I should have asked this in one of the other Stack forums, please let me know!