From d01b3f419c3ee6ead204d36f6c98b24dd29db13a Mon Sep 17 00:00:00 2001 From: Ed Espino Date: Tue, 10 Nov 2026 01:06:22 -0800 Subject: [PATCH] Fix: allow the community calendar embed The events page iframe is blocked because frame-src does not include calendar.google.com. Add that host only. --- static/.htaccess | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/static/.htaccess b/static/.htaccess index 737cb48d097..a6edb279e74 100644 --- a/static/.htaccess +++ b/static/.htaccess @@ -27,11 +27,12 @@ # connect-src https://proxy.kapa.ai, https://metrics.kapa.ai and Kapa's # Cloud Run proxy (the chat API), hCaptcha # style-src hCaptcha -# frame-src hCaptcha (the challenge iframe) +# frame-src hCaptcha (the challenge iframe), calendar.google.com +# (the community events embed) # # When adding another third-party service, append its hosts to the matching # directive(s) below. The policy must stay on one line: .htaccess cannot use # Define, and Apache has no string concatenation. - Header set Content-Security-Policy "default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://widget.kapa.ai https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://proxy.kapa.ai https://metrics.kapa.ai https://kapa-widget-proxy-la7dkmplpq-uc.a.run.app https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com; frame-ancestors 'self'; worker-src 'self' data: blob:;" + Header set Content-Security-Policy "default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://widget.kapa.ai https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://proxy.kapa.ai https://metrics.kapa.ai https://kapa-widget-proxy-la7dkmplpq-uc.a.run.app https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com https://calendar.google.com; frame-ancestors 'self'; worker-src 'self' data: blob:;"