cedric/annu-kute-ced
1
0
Fork 0
forked from ORGANISATION-KA-INTERNATIONALE/FEDIVERSE-OKI
Code Pull Requests Activity

Porte la section Funkwhale (MIZIK) et corrige la CSP par page

Browse Source 
- src/lib/server/funkwhale.ts : 50 morceaux aléatoires de mizik.o-k-i.net,
  filtre local, mapping vers le lecteur audio intégré (10 affichés)
- Section « Morceaux » sur l'accueil entre podcast et timeline, FR/EN
- Bus audio partagé (audio-bus.svelte.ts) : un seul flux à la fois entre
  le lecteur podcast et le lecteur musique
- Lecteur audio : méta générique (artiste — album) pour les morceaux
- CSP : mizik.o-k-i.net ajouté à img-src/media-src
- Fix critique : la balise meta CSP embarque désormais la politique complète
  (lue depuis _headers) — default-src 'self' seul bloquait par intersection
  les images et médias des instances ; frame-ancestors retiré de la meta
  (ignoré hors en-tête)
This commit is contained in:
sucupira
2026-07-23 01:19:22 -04:00
parent 28c2334927
commit ffe7f12fb9
11 changed files with 156 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/.htaccess
+1 -1
View File
@@ -19,7 +19,7 @@ ErrorDocument 404 /404.html
# Headers de sécurité
<IfModule mod_headers.c>
Header always set Content-Security-Policy "style-src 'self' 'unsafe-inline'; img-src 'self' data: https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net; font-src 'self'; connect-src 'self'; media-src 'self' https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net; frame-src https://gade.o-k-i.net; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'"
Header always set Content-Security-Policy "style-src 'self' 'unsafe-inline'; img-src 'self' data: https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net https://mizik.o-k-i.net; font-src 'self'; connect-src 'self'; media-src 'self' https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net https://mizik.o-k-i.net; frame-src https://gade.o-k-i.net; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'"
Header always set Strict-Transport-Security "max-age=31536000"
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
static/_headers
+1 -1
View File
@@ -1,5 +1,5 @@
/*
Content-Security-Policy: style-src 'self' 'unsafe-inline'; img-src 'self' data: https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net; font-src 'self'; connect-src 'self'; media-src 'self' https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net; frame-src https://gade.o-k-i.net; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'
Content-Security-Policy: style-src 'self' 'unsafe-inline'; img-src 'self' data: https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net https://mizik.o-k-i.net; font-src 'self'; connect-src 'self'; media-src 'self' https://gade.o-k-i.net https://kute.o-k-i.net https://bokante.o-k-i.net https://mizik.o-k-i.net; frame-src https://gade.o-k-i.net; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'
Strict-Transport-Security: max-age=31536000
X-Frame-Options: DENY
X-Content-Type-Options: nosniff