fix: media – TMDb img-src in CSP, Platzierungs-Badge auf Postern

2026-06-06 18:07:26 +02:00
parent 3bcc1cd9e6
commit 8a28a97b81
2 changed files with 12 additions and 4 deletions
--- a/backend/src/index.js
+++ b/backend/src/index.js
@@ -35,7 +35,7 @@ app.use((_req, res, next) => {
    // iCal-Feeds werden serverseitig geprosxt → nur 'self' nötig
    "connect-src 'self'",
    // data: für Avatare (base64), google.com + gstatic.com für Favicons im QuickLinks-Widget
-    "img-src 'self' data: https://www.google.com https://*.gstatic.com",
+    "img-src 'self' data: https://www.google.com https://*.gstatic.com https://image.tmdb.org",
    "worker-src 'self'",
    "object-src 'none'",
    "base-uri 'self'",