Content Security Policy errors in fresh install

[VitaminJ]

Version: 69.1.4
OS: Ubuntu 18.04

Install method: Installing in Linux (vodia.com) using the Debian commands (with sudo ./install-debian.sh)

The only steps taken to configure Vodia so far is to set the Administrator password and apply the licence.

The custom fonts for menu items are failing to load, showing ▯ instead.

Opening DevTools shows the following errors:

I note there was a similar topic posted a few months ago for 69.0.8, however a permanent solution wasn't listed.

[VitaminJ]

Fixed by adding data: to the Content-Security-Policy header for default-src in reg_head_css.html and welcome.html in Webpages (Administrator).

reg_head_css.html: 

[[#header name="Content-Security-Policy" content="default-src 'self' data: ; style-src 'unsafe-inline' 'self'; frame-ancestors none"]]

welcome.html: 

[[#header name="Content-Security-Policy" content="default-src 'self' data: https://accounts.google.com 'unsafe-inline'; child-src 'none'; frame-src https://accounts.google.com; frame-ancestors none"]]

 

[Vodia PBX]

We are in the process of releasing 69.2 can you try that version? There are still some warnings about some Google links, but there is not much we can do about that...

[VitaminJ]

Updated just now, and the same issue exists in 69.2.

Have to add data: to any content security policy headers to resolve, per the error message in DevTools.

[Vodia Support EU]

Hello,

Two things that are very interesting in this context (this behaviour is not normal). Firstly, you have the "OS: Ubuntu 18.04" operating system and Debian "sudo ./install-debian.sh" installed? I would also be interested to know where you have installed (I see this in context with a firewall).

 

[VitaminJ]

Forgive me if I'm wrong, but I believe Ubuntu is a Debian-based linux distribution, so a Debian-based install script would work on Ubuntu, yes?

It's installed in /usr/local/pbx, as defined in the install script from Installing in Linux (vodia.com)

The firewall has been configured per Used Ports (vodia.com), but I fail to see how this would result in the content security policy blocking fonts being loaded by data:.

[Vodia PBX]

The firewall (hopefully) does not even have the chance to see the content. Nor does the OS make any difference. 

Not sure why my browser does not complain, but that might be something installation specific. I don't see a problem adding the data:, we'll patch the 69.2 with that (just the .dat file). We already used it in the dom_logo.htm where we need it to render the images.