From cafa608e8c7bc78644b58ac46dfd406a5c4064c7 Mon Sep 17 00:00:00 2001
From: Gronod <gordon@i3omb.com>
Date: Sun, 17 May 2026 08:53:07 +0100
Subject: [PATCH] fix: allow inline style= attributes via CSP style-src-attr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Timing bars in the status panel and any other dynamically-injected
style= attributes were being silently blocked by the Content Security
Policy. style-src only governs <style> blocks and linked stylesheets;
inline element attributes need style-src-attr separately.

Adding style-src-attr 'unsafe-inline' is the minimal fix — it only
affects attribute-level inline styles, not script execution.

Also removes the temporary debug console.log added in the previous commit.
---
 public/app.js | 1 -
 server/app.js | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/app.js b/public/app.js
index cd65383..f441acc 100644
--- a/public/app.js
+++ b/public/app.js
@@ -705,7 +705,6 @@ function renderStatusPanel(data, panel) {
         <div class="status-card-title">Last Poll (${lp.totalMs}ms total, ${pollAge}s ago)</div>
         <div class="status-timings">`;
     const maxTaskMs = lp.tasks.reduce((max, t) => Math.max(max, t.ms), 1);
-    console.log('[Status] task timings:', JSON.stringify(lp.tasks), 'maxTaskMs:', maxTaskMs);
     for (const t of lp.tasks) {
       const barWidth = Math.max(2, (t.ms / maxTaskMs) * 100);
       html += `
diff --git a/server/app.js b/server/app.js
index ad98959..4ee54a3 100644
--- a/server/app.js
+++ b/server/app.js
@@ -42,6 +42,7 @@ function createApp({ skipRateLimits = false } = {}) {
           defaultSrc: ["'self'"],
           scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
           styleSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+          styleSrcAttr: ["'unsafe-inline'"],
           imgSrc: ["'self'", 'data:', 'blob:'],
           fontSrc: ["'self'", 'data:'],
           connectSrc: ["'self'"],