feat: enhance security audit and CSP configuration for admin interface

2026-07-23 14:12:05 +03:30
parent 9a43dcf798
commit f218bc17ef
5 changed files with 27 additions and 9 deletions
@@ -23,6 +23,11 @@ class AdminCspSubscriberTest extends WebTestCase
        // ALTCHA solves its proof-of-work inside blob: Web Workers; without this
        // directive the login captcha errors out (worker-src falls back to script-src).
        self::assertStringContainsString("worker-src 'self' blob:", $csp);
+        // The clinic-location map needs OSM tiles (img/connect), unpkg marker icons (img)
+        // and nominatim geocoding (connect); without these the map is blank + console errors.
+        self::assertStringContainsString('https://*.tile.openstreetmap.org', $csp);
+        self::assertStringContainsString('https://unpkg.com', $csp);
+        self::assertStringContainsString('https://nominatim.openstreetmap.org', $csp);
    }

    public function testNonAdminResponseDoesNotGetTheAdminCsp(): void