From 40ad555b36e3ae7b0267f15657b170d1b7ea9188 Mon Sep 17 00:00:00 2001 From: Jean Date: Tue, 7 Jul 2026 14:19:59 +0000 Subject: [PATCH] docs: sandbox media-src for audio-capable plugins (radio) --- docs/SANDBOX.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/SANDBOX.md b/docs/SANDBOX.md index 372114c..9117950 100644 --- a/docs/SANDBOX.md +++ b/docs/SANDBOX.md @@ -82,10 +82,15 @@ touch the app. ``` location = /app/plugin-sandbox.html { - add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; style-src 'unsafe-inline'; img-src data:; connect-src 'none'; frame-ancestors 'self'" always; + add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; style-src 'unsafe-inline'; img-src data:; media-src https:; connect-src 'none'; frame-ancestors 'self'" always; } ``` + `media-src https:` lets a sandboxed plugin play an audio/video stream in its own + iframe (e.g. the `orbit-radio` footer player). Playback stays contained — the + iframe still can't `fetch`, read the response, or reach the app. Drop it if no + deployment plugin needs media. + Applied live in `csp-app.conf` / `chat-headers.conf` (added `'self'` to `frame-src`) and a `location = /app/plugin-sandbox.html` block in `tchatou-app-backend.conf`. Note: nginx *reload* cannot rekey a shared-memory zone, so activating this needed a