CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Outgoing mails: Fix cross-browser support

Browse Source
This commit is contained in:
Raphael Michel
2026-01-30 11:37:10 +01:00
parent c40e34af57
commit 8c4e0bdb82
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/pretix/control/views/mail.py
View File

@@ -112,6 +112,9 @@ class OutgoingMailDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequir
h = {} h = {}
csps = { csps = {
'frame-src': ['data:'], 'frame-src': ['data:'],
# Unfortuantely, we can't avoid unsafe-inline for style here.
# See outgoingmail.js for the protection measures we take.
'style-src': ["'unsafe-inline'"],
} }
_merge_csp(h, csps) _merge_csp(h, csps)
response['Content-Security-Policy'] = _render_csp(h) response['Content-Security-Policy'] = _render_csp(h)

4
src/pretix/static/pretixcontrol/js/ui/outgoingmail.js
View File

@@ -6,7 +6,7 @@ function is_sandbox_supported() {
function safe_render(url, parent) { function safe_render(url, parent) {
// Estimate the height that prevents the user from having to scroll on two levels to see the full email // Estimate the height that prevents the user from having to scroll on two levels to see the full email
const height = ( const height = (
window.innerHeight - parent.parent().get(0).getBoundingClientRect().top - document.querySelector("footer").getBoundingClientRect().height - 20 Math.max(400, window.innerHeight - parent.parent().get(0).getBoundingClientRect().top - document.querySelector("footer").getBoundingClientRect().height - 20)
) + "px"; ) + "px";
const iframe = ( const iframe = (
@@ -22,7 +22,7 @@ function safe_render(url, parent) {
.attr("class", "html-email") .attr("class", "html-email")
.attr("src", url) .attr("src", url)
.attr("sandbox", "allow-popups allow-popups-to-escape-sandbox") .attr("sandbox", "allow-popups allow-popups-to-escape-sandbox")
.attr("csp", "script-src 'none'; font-src 'none'; connect-src 'none'; form-action 'none'") // respected only by chrome .attr("csp", "script-src 'none'; font-src 'none'; connect-src 'none'; form-action 'none'; style-src 'unsafe-inline'") // respected only by chrome
.prop("credentialless", true) // respected only by chrome .prop("credentialless", true) // respected only by chrome
); );