arunk-kumar opened a new pull request, #495: URL: https://github.com/apache/ozone-site/pull/495
## What changes were proposed in this pull request? Add `https://github.com/` and `https://*.githubusercontent.com/` to `CSP_PROJECT_DOMAINS` in `static/.htaccess`. Please describe your PR in detail: The blog contributor cards use `image_url: https://github.com/<user>.png` for individual authors (see `blog/authors.yml`). That URL 302-redirects to `avatars.githubusercontent.com`, so the browser needs CSP permission for **both** origins. No `img-src` is set today, so `default-src` applies and blocks the images — the contributor avatars don't render. JIRA: https://issues.apache.org/jira/browse/HDDS-15884 ## Alternative Bundle avatars into the repo and point `authors.yml` at local paths. Avoids the CSP change and the redirect hop, but every contributor add/refresh becomes a commit. Happy to switch if reviewers prefer. ## How was this patch tested? - Redirect chain confirmed: `curl -sI https://github.com/<user>.png` → `HTTP/2 302` → `location: https://avatars.githubusercontent.com/...`, so CSP must allow both origins. - Local httpd 2.4 smoke test with this `.htaccess` plus a stub `Header set Content-Security-Policy ... %{CSP_PROJECT_DOMAINS}e ...` emits both `https://github.com/` and `https://*.githubusercontent.com/` in the resulting header. Reverting the patch drops both origins; restoring it puts them back. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
