From 35822e7f2554f8d8168e51c9135c1937df08b7f0 Mon Sep 17 00:00:00 2001
From: Richard Schreiber <schreiber@rami.io>
Date: Mon, 16 Mar 2026 15:03:06 +0100
Subject: [PATCH] do not ignore csp even for disposition=inline

---
 src/pretix/control/views/event.py           | 1 -
 src/pretix/control/views/global_settings.py | 1 -
 2 files changed, 2 deletions(-)

diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py
index d09a833181..de0ef49731 100644
--- a/src/pretix/control/views/event.py
+++ b/src/pretix/control/views/event.py
@@ -746,7 +746,6 @@ class InvoicePreview(EventPermissionRequiredMixin, View):
         if settings.DEBUG:
             # attachment is more secure as we're dealing with user-generated stuff here, but inline is much more convenient during debugging
             resp['Content-Disposition'] = 'inline; filename="{}"'.format(fname)
-            resp._csp_ignore = True
         else:
             resp['Content-Disposition'] = 'attachment; filename="{}"'.format(fname)
         return resp
diff --git a/src/pretix/control/views/global_settings.py b/src/pretix/control/views/global_settings.py
index 815019bc0b..d5c6b0a55b 100644
--- a/src/pretix/control/views/global_settings.py
+++ b/src/pretix/control/views/global_settings.py
@@ -300,5 +300,4 @@ class SysReportView(AdministratorPermissionRequiredMixin, TemplateView):
             resp = HttpResponse(data)
             resp['Content-Type'] = mime
             resp['Content-Disposition'] = 'inline; filename="{}"'.format(name)
-            resp._csp_ignore = True
             return resp