From 04fa489961a8f861f60e04840ae4d99470a7c437 Mon Sep 17 00:00:00 2001
From: "Brian J. Fox" <bfox@brianjfox.com>
Date: Tue, 3 Nov 2026 13:02:01 +0000
Subject: [PATCH] fix(web): let the page show blob: images, so attached
 pictures get thumbnails

The attachment components preview a picture from an object URL, which is a blob: URL the page's Content Security Policy did not allow, so every attached picture showed as its type instead.
---
 apps/web/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/index.html b/apps/web/index.html
index 5104278d..7e9de31b 100644
--- a/apps/web/index.html
+++ b/apps/web/index.html
@@ -4,7 +4,7 @@
     <meta charset="utf-8" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws:; frame-src 'self' http://localhost:* http://127.0.0.1:*; base-uri 'self'; form-action 'self'"
+      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' ws:; frame-src 'self' http://localhost:* http://127.0.0.1:*; base-uri 'self'; form-action 'self'"
     />
     <meta name="referrer" content="no-referrer" />
     <meta