fix theme switch to default bug and include google fonts in csp #6665

Signed-off-by: si458 <[email protected]>

public/scripts/themes/theme-switcher.js

@@ -4,8 +4,8 @@ document.addEventListener("DOMContentLoaded", function () {
   // Load saved theme from local storage
   const savedTheme = localStorage.getItem("theme");
   if (savedTheme) {
-    const safeTheme = encodeURIComponent(savedTheme);
-    themeStylesheet.href = `styles/themes/${safeTheme}/bootstrap.min.css`;
+    const safeTheme = ((savedTheme != 'default') ? encodeURIComponent(savedTheme) : encodeURIComponent('..'));
+    themeStylesheet.href = `styles/themes/${safeTheme}/bootstrap-min.css`;
   }
 
   // Initialize Select2 on all select elements with the 'select2' class

views/default3.handlebars

@@ -14138,10 +14138,9 @@
         function account_switchThemeEx() {
             var themeSwitcher = document.getElementById('theme-switcher');
             const selectedTheme = themeSwitcher.value;
-            const safeTheme = encodeURIComponent(selectedTheme);
+            const safeTheme = ((selectedTheme != 'default') ? encodeURIComponent(selectedTheme) : encodeURIComponent('..'));
             var themeStylesheet = document.getElementById('theme-stylesheet');
-            var newThemeStylesheet = `styles/themes/${safeTheme}/bootstrap.min.css`;
-            themeStylesheet.href = newThemeStylesheet;
+            themeStylesheet.href = `styles/themes/${safeTheme}/bootstrap-min.css`;
             // Save selected theme
             putstore('theme', selectedTheme);
             // Update last 4 themes selected

webserver.js

@@ -6502,7 +6502,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
                 'Referrer-Policy': 'no-referrer',
                 'X-XSS-Protection': '1; mode=block',
                 'X-Content-Type-Options': 'nosniff',
-                'Content-Security-Policy': "default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'" + extraScriptSrc + "; connect-src 'self'" + geourl + selfurl + "; img-src 'self' blob: data:" + geourl + " data:; style-src 'self' 'unsafe-inline'; frame-src 'self' blob: mcrouter:" + extraFrameSrc + "; media-src 'self'; form-action 'self'; manifest-src 'self'"
+                'Content-Security-Policy': "default-src 'none'; font-src 'self' fonts.gstatic.com data:; script-src 'self' 'unsafe-inline' " + extraScriptSrc + "; connect-src 'self'" + geourl + selfurl + "; img-src 'self' blob: data:" + geourl + " data:; style-src 'self' 'unsafe-inline' fonts.googleapis.com; frame-src 'self' blob: mcrouter:" + extraFrameSrc + "; media-src 'self'; form-action 'self'; manifest-src 'self'"
             };
             if (req.headers['user-agent'] && (req.headers['user-agent'].indexOf('Chrome') >= 0)) { headers['Permissions-Policy'] = 'interest-cohort=()'; } // Remove Google's FLoC Network, only send this if Chrome browser
             if ((parent.config.settings.allowframing !== true) && (typeof parent.config.settings.allowframing !== 'string')) { headers['X-Frame-Options'] = 'sameorigin'; }