Add proper CSP policy for HTML email preview

2026-08-06 10:07:50 +00:00 · 2026-07-03 11:00:58 +02:00
parent 120317a8f2
commit e938190221
1 changed files with 6 additions and 1 deletions
@@ -952,7 +952,12 @@ class MailSettingsRendererPreview(MailSettingsPreview):
                    context=context,
                )
                r = HttpResponse(v, content_type='text/html')
-                r._csp_ignore = True
+                r['Content-Security-Policy'] = (
+                    # Plugin-provided email templates will contain inline styles or remote images
+                    # but emails should not contain JS
+                    "style-src 'unsafe-inline'; "
+                    "img-src https: data:"
+                )
                return r
        else:
            raise Http404(_('Unknown email renderer.'))