Add data: as image src.

diff --git a/customer/spd/development.yaml b/customer/spd/development.yaml
index 861b09f78778f303b672794c18c63ab832f2d96d..728708aa07910d53262847061eda50df5d4a0f99 100644 (file)
--- a/customer/spd/development.yaml
+++ b/customer/spd/development.yaml
@@ -57,8 +57,8 @@ site::profile::typo3::projects:
       - 'set X-Frame-Options: sameorigin'
       - 'set X-XSS-Protection: "1; mode=block"'
       - 'set X-Content-Type-Options: nosniff'
-      - "set Content-Security-Policy: \"default-src 'self'; img-src 'self' analytics.spd.de; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline' api.spendino.de storify.com analytics.spd.de; frame-src 'self' analytics.spd.de w.soundcloud.com player.vimeo.com www.youtube.com www.youtube-nocookie.com api.spendino.de storify.com streaming.b1group.de; frame-ancestors 'self'\""
-      - "set X-Content-Security-Policy: \"default-src 'self'; img-src 'self' analytics.spd.de; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline' api.spendino.de storify.com analytics.spd.de; frame-src 'self' analytics.spd.de w.soundcloud.com player.vimeo.com www.youtube.com www.youtube-nocookie.com api.spendino.de storify.com streaming.b1group.de; frame-ancestors 'self'\""
+      - "set Content-Security-Policy: \"default-src 'self'; img-src 'self' analytics.spd.de data:; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline' api.spendino.de storify.com analytics.spd.de; frame-src 'self' analytics.spd.de w.soundcloud.com player.vimeo.com www.youtube.com www.youtube-nocookie.com api.spendino.de storify.com streaming.b1group.de; frame-ancestors 'self'\""
+      - "set X-Content-Security-Policy: \"default-src 'self'; img-src 'self' analytics.spd.de data:; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline' api.spendino.de storify.com analytics.spd.de; frame-src 'self' analytics.spd.de w.soundcloud.com player.vimeo.com www.youtube.com www.youtube-nocookie.com api.spendino.de storify.com streaming.b1group.de; frame-ancestors 'self'\""
     headers_ssl:
       - 'always set Strict-Transport-Security "max-age=31556926"'
     directories: