mirror of
https://github.com/suitenumerique/meet.git
synced 2026-07-26 11:58:53 +00:00
lebaudantoine
69a6dd1463
The CSP was missing a default-src directive (flagged by CodeRabbit). Without it, styles, images, fonts, and media are completely unrestricted, which undercuts the otherwise strict policy. Set default-src to 'self' and add an explicit style-src directive since we rely on inline styles (e.g. #close-msg and the view toggling use inline style attributes), so style-src needs to allow 'self' and 'unsafe-inline'.