From e938190221f37935b4fa82fbb5dc6bd3fe9d36b6 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Fri, 3 Jul 2026 10:24:07 +0200 Subject: [PATCH] Add proper CSP policy for HTML email preview --- src/pretix/control/views/event.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py index 7ff3aa8bdb..3e75d28925 100644 --- a/src/pretix/control/views/event.py +++ b/src/pretix/control/views/event.py @@ -952,7 +952,12 @@ class MailSettingsRendererPreview(MailSettingsPreview): context=context, ) r = HttpResponse(v, content_type='text/html') - r._csp_ignore = True + r['Content-Security-Policy'] = ( + # Plugin-provided email templates will contain inline styles or remote images + # but emails should not contain JS + "style-src 'unsafe-inline'; " + "img-src https: data:" + ) return r else: raise Http404(_('Unknown email renderer.'))