From 37bd490072a6703782f6ae19a124abb4be9749e2 Mon Sep 17 00:00:00 2001
From: Denis Teyssier <admin@mascali.ovh>
Date: Mon, 20 Apr 2026 09:03:05 +0200
Subject: [PATCH 1/3] fix: added media-src CSP rule for media attachments #209

---
 proxy.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/proxy.ts b/proxy.ts
index 348328a2..f7e087d6 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -28,6 +28,7 @@ export function proxy(request: NextRequest) {
     `base-uri 'self'`,
     `form-action 'self'`,
     `frame-ancestors ${frameAncestors}`,
+    `media-src 'self' blob:`,
   ].join("; ");
 
   // Skip intl middleware for /admin routes - they have their own layout

From e73ffa7449a5763c4c4270beb2023914d58a462b Mon Sep 17 00:00:00 2001
From: Denis Teyssier <admin@mascali.ovh>
Date: Mon, 20 Apr 2026 09:03:50 +0200
Subject: [PATCH 2/3] fix: added sandbox allow-scripts to PDF file preview
 modal #209

---
 components/files/file-preview-modal.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/files/file-preview-modal.tsx b/components/files/file-preview-modal.tsx
index f18c72c5..0dc1dcae 100644
--- a/components/files/file-preview-modal.tsx
+++ b/components/files/file-preview-modal.tsx
@@ -223,7 +223,7 @@ export function FilePreviewModal({ name, onClose, onDownload, getFileContent }:
         {!loading && !error && fileType === "pdf" && objectUrl && (
           <iframe
             src={objectUrl}
-            sandbox="allow-same-origin"
+            sandbox="allow-same-origin allow-scripts"
             className="w-full max-w-5xl h-full rounded-lg bg-white"
             title={name}
           />

From c3960a99be09526dfed630487c1b94e9a1ebff56 Mon Sep 17 00:00:00 2001
From: Denis Teyssier <admin@mascali.ovh>
Date: Mon, 20 Apr 2026 14:53:31 +0200
Subject: [PATCH 3/3] fix: removed allow-same-origin to avoid anti-pattern
 permissions on iframe sandbox #209

---
 components/files/file-preview-modal.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/files/file-preview-modal.tsx b/components/files/file-preview-modal.tsx
index 0dc1dcae..d751e0a2 100644
--- a/components/files/file-preview-modal.tsx
+++ b/components/files/file-preview-modal.tsx
@@ -223,7 +223,7 @@ export function FilePreviewModal({ name, onClose, onDownload, getFileContent }:
         {!loading && !error && fileType === "pdf" && objectUrl && (
           <iframe
             src={objectUrl}
-            sandbox="allow-same-origin allow-scripts"
+            sandbox="allow-scripts"
             className="w-full max-w-5xl h-full rounded-lg bg-white"
             title={name}
           />