From 21bcca798b8c4b6110cda4d1bbe4026e2dae5b70 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Fri, 19 Jun 2026 02:21:41 +0800
Subject: [PATCH] fix: csp (#38162)

ref:
https://github.com/go-gitea/gitea/issues/8707#issuecomment-4741577316
---
 services/context/context_template.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/services/context/context_template.go b/services/context/context_template.go
index c458912e69e..87877095abf 100644
--- a/services/context/context_template.go
+++ b/services/context/context_template.go
@@ -132,8 +132,9 @@ func (c TemplateContext) HeadMetaContentSecurityPolicy() template.HTML {
 	//    * Maybe this approach should be avoided, don't make the config system too complex, just let users use A
 	return template.HTML(`<meta http-equiv="Content-Security-Policy" content="` +
 		// allow all by default (the same as old releases with no CSP)
-		// maybe some images or markup (external) renders need "data:", need to investigate
-		`default-src * data:;` +
+		// * maybe some images or markup (external) renders need "data:", need to investigate
+		// * avatar upload editor needs "blob:", at least "img-src" and "content-src"
+		`default-src * data: blob:;` +
 
 		// enforce nonce for all scripts, disallow inline scripts
 		`script-src * 'nonce-` + c.CspScriptNonce() + `';` +