mirror of
https://github.com/logicog/RTLPlayground.git
synced 2026-08-30 14:52:51 +08:00
d00f
ed74ec1e97
Two hygiene fixes for the web UI, prompted by a login that appeared to fail under privacy shields (Brave Shields / NoScript-family extensions): - httpd: replace the partial "style-src 'self' 'unsafe-inline'" CSP with a complete, first-party policy (default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; form-action 'self'). Everything the UI needs is same-origin; the explicit policy stops shields injecting their own restrictive report-only probes (the noisy script-src-elem 'none' console spam) and passes a strict-CSP audit. Verified: no CSP violations in-browser. - login.html: add autocomplete="current-password" so password managers recognise the field (they showed "unknown password" without it). NOTE: these do NOT bypass a browser's LAN-device protection (NoScript "lan" / Brave Shields), which strips the POST body of requests to a LAN address and is why the login can fail in-browser while the same credentials work over curl. That is a deliberate browser security feature; the user must allow the site in their shields to log in. The backend password (default 1234) is unchanged and correct.
