Fix CSP: allow inline event-handler attrs (script-src-attr) so admin tabs/filters/onerror fallbacks work; add favicon route. Verified 13/13 desktop+mobile

4f61ddfa766c04528180276d5ccb1ce17ec8a8fe · 2026-07-04 13:39:10 -0700 · Steve

Files touched

M server.js

Diff

commit 4f61ddfa766c04528180276d5ccb1ce17ec8a8fe
Author: Steve <steve@designerwallcoverings.com>
Date:   Sat Jul 4 13:39:10 2026 -0700

    Fix CSP: allow inline event-handler attrs (script-src-attr) so admin tabs/filters/onerror fallbacks work; add favicon route. Verified 13/13 desktop+mobile
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 297e7d6..92c8e2b 100644
--- a/server.js
+++ b/server.js
@@ -48,6 +48,10 @@ app.use(helmet({
     directives: {
       defaultSrc: ["'self'"],
       scriptSrc: ["'self'", "'unsafe-inline'"],
+      // inline event-handler attributes (onclick=, onerror=) are a separate directive;
+      // Helmet defaults it to 'none'. The site/admin use inline handlers (house style,
+      // Basic-Auth admin, no user-generated content) so allow them explicitly.
+      scriptSrcAttr: ["'unsafe-inline'"],
       styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
       fontSrc: ["'self'", 'https://fonts.gstatic.com', 'data:'],
       imgSrc: ["'self'", 'data:', 'https:'],
@@ -189,6 +193,10 @@ app.get('/api/admin/leads', (req, res) => {
 });
 
 // ---- static + clean URLs ---------------------------------------------------
+// Inline SVG favicon (avoids a 404 on the browser's automatic request).
+app.get('/favicon.svg', (req, res) => res.type('image/svg+xml').send(
+  '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="7" fill="#0a84ff"/><text x="16" y="22" font-size="18" text-anchor="middle">🚗</text></svg>'));
+app.get('/favicon.ico', (req, res) => res.redirect(302, '/favicon.svg'));
 app.use('/media', express.static(path.join(__dirname, 'media')));
 app.get(/^\/(.+)\.html$/, (req, res) => res.redirect(301, '/' + req.params[0]));
 app.use(express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));

← b94f670 Add scripts: db schema, gen-media (Nano Banana + SeeDance, d · back to Prestige Car Wash · Contrarian FIX-FIRST pass: real hero copy (no terminal cmd), 36db139 →