From ebcbf4570e5bcd2d92f40adb8d7e04f5a03b2819 Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Mon, 29 Jan 2024 16:15:56 +0100
Subject: [PATCH] Remove custom HTTP headers for diagrams

---
 lib/defaults.js    | 4 ----
 lib/http-worker.js | 4 ----
 2 files changed, 8 deletions(-)

diff --git a/lib/defaults.js b/lib/defaults.js
index b149acabc..3d342a659 100644
--- a/lib/defaults.js
+++ b/lib/defaults.js
@@ -52,10 +52,6 @@ Default.padContentSecurity = function (Env) {
     return (Default.commonCSP(Env).join('; ') + "script-src 'self' 'unsafe-eval' 'unsafe-inline' resource: " + Env.httpUnsafeOrigin).replace(/\s+/g, ' ');
 };
 
-Default.diagramContentSecurity = function (Env) {
-    return (Default.commonCSP(Env).join('; ') + "script-src 'self' resource: " + Env.httpUnsafeOrigin).replace('img-src ', 'img-src http: https: ').replace(/\s+/g, ' ');
-};
-
 Default.httpHeaders = function (Env) {
     return {
         "X-XSS-Protection": "1; mode=block",
diff --git a/lib/http-worker.js b/lib/http-worker.js
index be59617e5..fbcacbeb4 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -127,8 +127,6 @@ var getHeaders = function (Env, type) {
     var csp;
     if (type === 'office') {
         csp = Default.padContentSecurity(Env);
-    } else if (type === 'diagram') {
-        csp = Default.diagramContentSecurity(Env);
     } else {
         csp = Default.contentSecurity(Env);
     }
@@ -151,8 +149,6 @@ var setHeaders = function (req, res) {
         type = 'office';
     } else if (/^\/api\/(broadcast|config)/.test(req.url)) {
         type = 'api';
-    } else if (/^\/components\/drawio\/src\/main\/webapp\/index.html.*$/.test(req.url)) {
-        type = 'diagram';
     } else {
         type = 'standard';
     }