From 09eb887cf7e68a4cf9ef411d2fa207dbf4575a6a Mon Sep 17 00:00:00 2001
From: xadyz1 <ivandro.work@gmail.com>
Date: Sun, 26 Jul 2026 14:31:15 +0100
Subject: [PATCH] .

---
 server/db/remote_display.db-client_wal_index | Bin 32 -> 32 bytes
 server/server.js                             |   4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/db/remote_display.db-client_wal_index b/server/db/remote_display.db-client_wal_index
index c4e1bd82da9cfdf3bd58d3c8fd1de8722462effa..fd759e1d8e69d2bcbf52fb2bb315b4b8b354ba49 100644
GIT binary patch
literal 32
ccmcbvsLU#6F?(i>8<R!b_2}a5Yz!y>0F{>phX4Qo

literal 32
ccmcbvsLU#6F?(i>8<R!b_2}X)Yz!y>0F`G3ga7~l

diff --git a/server/server.js b/server/server.js
index 8c0eccc..7c499c9 100644
--- a/server/server.js
+++ b/server/server.js
@@ -97,13 +97,13 @@ const dashboardCsp = helmet.contentSecurityPolicy({
     // Both are required — with only the script entry the beacon loads but silently can't report.
     scriptSrc: ["'self'", 'https://static.cloudflareinsights.com'],
     scriptSrcAttr: ["'unsafe-inline'"],
-    styleSrc: ["'self'", "'unsafe-inline'"],
+    styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
     styleSrcAttr: ["'unsafe-inline'"],
     imgSrc: ["'self'", 'data:', 'blob:', 'https:'],
     mediaSrc: ["'self'", 'blob:', 'https:'],
     // 'wss:'/'ws:' keep the dashboard's socket.io connection working; the CF entry lets the beacon report.
     connectSrc: ["'self'", 'wss:', 'ws:', 'https:', 'https://cloudflareinsights.com'],
-    fontSrc: ["'self'", 'data:'],
+    fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
     frameSrc: ["'self'", 'https://www.youtube.com', 'https://youtube.com'],
     objectSrc: ["'none'"],
     baseUri: ["'self'"],