search

robinparisi / tingle

⚡ 2kB vanilla modal plugin, no dependencies and easy-to-use
https://tingle.robinparisi.com
MIT License
1.55k stars 185 forks source link

CSS cursor rule is causing Content Security Policy warnings #153

Open The-Paavo opened 3 years ago

The-Paavo commented 3 years ago

Just FYI. Commit 5ecc2c2eed437f3e8d62ca7b5733d6a29669f6b9 is a little bit problematic, if Content Security Policies doesn't allow insecure data: schemes. It's usually not allowed, if CSP is defined. When it's not allowed, browsers refuse to use that svg-image (cursor) and they complain about it in "console".

csp

It can be fixed by removing or overriding this css-rule. .tingle-modal { cursor: auto; } is enough to override this.

Could this cursor-thingy perhaps be optional or just use standard cursor keywords? https://developer.mozilla.org/en-US/docs/Web/CSS/cursor

Other than that, 0.16.0 is working smoothly. 👍

robinparisi commented 3 years ago

Hi @The-Paavo,

I hadn't thought about CSP, that's too bad since I think it's better for UX (not everyone is used to click outside to close a modal). I think I'm just going to revert this commit because I prefer to avoid compromising on security and an external link wouldn't be as easy to use.