Jul 14 - Using CDN - Fix web CSP

app/__init__.py

@@ -234,6 +234,18 @@ def create_app(config_name='default'):
     # ── Security response headers ─────────────────────────────────────────
     # Applied to every response. Blocks clickjacking, MIME sniffing, and
     # obvious XSS vectors without breaking Bootstrap CDN / Google Fonts.
+    # Allow R2 presigned photo URLs in the CSP img-src when the s3 storage
+    # backend is configured. Derived from R2_ENDPOINT_URL (the presigned URL
+    # host is the same R2 account endpoint), so nothing is hardcoded and the
+    # local backend is unaffected.
+    _r2_img_src = ''
+    _r2_endpoint = app.config.get('R2_ENDPOINT_URL')
+    if _r2_endpoint:
+        from urllib.parse import urlparse
+        _r2_host = urlparse(_r2_endpoint).netloc
+        if _r2_host:
+            _r2_img_src = f' https://{_r2_host}'
+
     @app.after_request
     def set_security_headers(response):
         response.headers.setdefault('X-Content-Type-Options', 'nosniff')
@@ -245,7 +257,7 @@ def create_app(config_name='default'):
             "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
             "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; "
             "font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net; "
-            "img-src 'self' data: blob: https://maps.gstatic.com https://maps.googleapis.com; "
+            f"img-src 'self' data: blob: https://maps.gstatic.com https://maps.googleapis.com{_r2_img_src}; "
             "connect-src 'self' https://cdn.jsdelivr.net; "
             "frame-src https://maps.google.com https://www.google.com; "
             "frame-ancestors 'none';"