diff --git a/index.html b/index.html index a9eb075a4ae..0edb0c06956 100644 --- a/index.html +++ b/index.html @@ -12,7 +12,11 @@ "secured": "{{ .Secured }}" } - + diff --git a/vite.config.ts b/vite.config.ts index 0a67164fc95..be6721e28a8 100644 --- a/vite.config.ts +++ b/vite.config.ts @@ -11,7 +11,7 @@ export default defineConfig(({ mode }) => ({ "@/": `${path.resolve(__dirname, "assets")}/`, }, }, - base: mode === "production" ? "/<__BASE__>/" : "/", + base: mode === "production" ? "/{{ .Base }}/" : "/", plugins: [ vue(), Icons({ @@ -41,8 +41,9 @@ export default defineConfig(({ mode }) => ({ const htmlPlugin = (mode) => { return { name: "html-transform", + enforce: "post", transformIndexHtml(html) { - return mode === "production" ? html.replaceAll("/<__BASE__>", "{{ .Base }}") : html; + return mode === "production" ? html.replaceAll("/{{ .Base }}/", "{{ .Base }}/") : html; }, }; }; diff --git a/web/__snapshots__/web.snapshot b/web/__snapshots__/web.snapshot index 7a28b04d4e4..aa0f9b2c9db 100644 --- a/web/__snapshots__/web.snapshot +++ b/web/__snapshots__/web.snapshot @@ -1,7 +1,7 @@ /* snapshot: Test_createRoutes_foobar */ HTTP/1.1 200 OK Connection: close -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/plain; charset=utf-8 foo page @@ -9,7 +9,7 @@ foo page /* snapshot: Test_createRoutes_index */ HTTP/1.1 200 OK Connection: close -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/plain; charset=utf-8 index page @@ -17,7 +17,7 @@ index page /* snapshot: Test_createRoutes_redirect */ HTTP/1.1 301 Moved Permanently Connection: close -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/html; charset=utf-8 Location: /foobar/ @@ -26,7 +26,7 @@ Location: /foobar/ /* snapshot: Test_createRoutes_redirect_with_auth */ HTTP/1.1 307 Temporary Redirect Connection: close -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/html; charset=utf-8 Location: /foobar/login @@ -35,7 +35,7 @@ Location: /foobar/login /* snapshot: Test_createRoutes_username_password */ HTTP/1.1 307 Temporary Redirect Connection: close -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/html; charset=utf-8 Location: /login @@ -44,7 +44,7 @@ Location: /login /* snapshot: Test_createRoutes_username_password_invalid */ HTTP/1.1 401 Unauthorized Connection: close -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff @@ -56,7 +56,7 @@ Connection: close Cache-Control: no-transform Cache-Control: no-cache Connection: keep-alive -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/event-stream X-Accel-Buffering: no @@ -66,7 +66,7 @@ data: end of stream /* snapshot: Test_createRoutes_version */ HTTP/1.1 200 OK Connection: close -Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com; +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com; Content-Type: text/html 
dev
diff --git a/web/csp.go b/web/csp.go index 7d4b41a9fff..a4b712c6656 100644 --- a/web/csp.go +++ b/web/csp.go @@ -6,7 +6,7 @@ import ( func cspHeaders(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Content-Security-Policy", "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; manifest-src 'self'; connect-src 'self' api.github.com;") + w.Header().Set("Content-Security-Policy", "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; connect-src 'self' api.github.com;") next.ServeHTTP(w, r) }) }