Maps does not load map tiles because of Content Security Policy

[jancborchardt]

From the JS log:

Refused to load the image 'http://otile2.mqcdn.com/tiles/1.0.0/osm/16/34944/19841.png'
because it violates the following Content Security Policy directive: "img-src 'self'".
Refused to load the image 'http://otile1.mqcdn.com/tiles/1.0.0/osm/16/34943/19841.png'
because it violates the following Content Security Policy directive: "img-src 'self'".
Refused to load the image 'http://otile1.mqcdn.com/tiles/1.0.0/osm/16/34944/19840.png'
because it violates the following Content Security Policy directive: "img-src 'self'".

@LukasReschke any idea?

cc @brantje @DJaeger @houqp

[DJaeger]

For me it is working like expected. The CORS of MapQuest tiles is "Access-Control-Allow-Origin: *" so it is allowed to load the tiles from every origin. Do you use a local address?

[jancborchardt]

Yeah, I use localhost. Anything I need to adjust then?

[DJaeger]

CORS is not working on localhost. You have to use a public accessible address.

[Henni]

@DJaeger is there any way to make it work locally as it's quite an effort to develop on a remote machine instead of developing locally? Especially because owncloud makes it so easy to setup a local development environment with ocdev.

[v1r0x]

I have the same problem, but instead of localhost I use a public domain.

I get these errors (in german):

Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf self blockiert ("script-src https://my.url 'unsafe-eval'").
onsubmit attribute on DIV element

Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf http://otile3.mqcdn.com/tiles/1.0.0/osm/15/17210/11312.png blockiert ("img-src https://my.url").

[DJaeger]

Which version of owncloud and maps and which browser in which version do you both use?

[Henni]

Works for me now. It was broken for me a while back on previous versions of core and maps. (BTW I'm now using the master of core and maps and the current Chrome beta)

[DJaeger]

That's great, as the current version should work.

[Henni]

I just switched between branches on core and now it broke again. Even switching back to the previous branch doesn't help.

Now the icons are missing and the map tiles don't load:

edit: maybe this has something to do with http/https.

[v1r0x]

Which version of owncloud and maps and which browser in which version do you both use?

I'm using 8.1.0 (stable), the current maps master and latest firefox beta 40 (and for testing chromium v37)

[DJaeger]

Mhm, this seems to be introduced with one of the last updates of core. I'm on 8.0.4 and it works without issues.

[LukasReschke]

Read https://statuscode.ch/2015/04/content-security-policy-and-ownCloud/ and take a look at https://github.com/owncloud/core/pull/13989, you need to add a img-src policy allowing each of these domains or even *.

[DJaeger]

Ok, that was new to me as I'm not on 8.1. Great article. But this would make the app not compatible with core <8.1 So maintain a lagacy version or simply work towards a >=8.1 version?

[brantje]

@DJaeger A stable7 and a stable8 would be the best imo.

[jancborchardt]

@DJaeger @brantje If it would be a more established app, I would say we need to support stable7 and stable8.

But seeing how the app is not even published on apps.owncloud.com yet I assume it doesn’t have a lot of users. I would say it’s fine if we say we just support 8.1 and later. Then we can focus on development and don’t need to maintain a bunch of old stuff.

[LukasReschke]

But this would make the app not compatible with core <8.1

Not necessarily.

if (class_exists('OCP\AppFramework\Http\ContentSecurityPolicy')) {
    …
}

[Henni]

@LukasReschke Is it possible in php to encapsulate a use inside of an if?

if (class_exists('OCP\AppFramework\Http\ContentSecurityPolicy')) {
   use \OCP\AppFramework\Http\ContentSecurityPolicy; 
}

[LukasReschke]

No. You need to use the full namespace in this case then instead of a use statement.

[DJaeger]

I agree with @jancborchardt to simply move forward to a "release" version, which will than compatible with current versions at the time of release. With the propose of @LukasReschke, is still only oc8 supported and no oc7, or am I wrong?