fix: Add https: to image CSP to allow external images (coder#2870)

kylecarbs · web-flow · commit c801da45f335 · 2022-07-08T21:35:59.000-05:00
This broke external application icons.
diff --git a/site/site.go b/site/site.go
@@ -280,7 +280,7 @@ func cspHeaders(next http.Handler) http.Handler {
 			// https: allows loading images from external sources. This is not ideal
 			// 	but is required for the templates page that renders readmes.
 			//	We should find a better solution in the future.
-			CSPDirectiveImgSrc:     {"'self' data:"},
+			CSPDirectiveImgSrc:     {"'self' https: data:"},
 			CSPDirectiveFormAction: {"'self'"},
 			CSPDirectiveMediaSrc:   {"'self'"},
 			// Report all violations back to the server to log
