search

nextcloud / photos

📸 Your memories under your control
GNU Affero General Public License v3.0
516 stars 59 forks source link

Content Security Policy issues #2498

Open stweil opened 3 weeks ago

stweil commented 3 weeks ago

Describe the bug The current code (Nextcloud Hub 8 29.0.2) triggers CSP errors "EvalError: call to eval() blocked by CSP".

Each of those errors indicates that some JavaScript code was blocked, that means not processed.

I noticed those errors while I tried to find out why no images were shown for unsigned faces (https://[...]/apps/photos/faces/unassigned), but it looks like CSP errors are throwns on any page which is part of photos.

To Reproduce Steps to reproduce the behavior:

  1. Open https://[...]/apps/photos/ in recent Firefox
  2. Activate tools for web developers in Firefox
  3. Inspect console in tools for web developers
  4. See error

Expected behavior There should not be any CSP errors.

Desktop (please complete the following information):

Browser log

EvalError: call to eval() blocked by CSP
    o moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    <anonym> moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    <anonym> moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    <anonym> moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    inject resource://gre/modules/ExtensionContent.sys.mjs:573
    InterpretGeneratorResume self-hosted:1412
    AsyncFunctionNext self-hosted:799