UI updates and remove CSP for plugins

Overlord-Server/src/server/http-utils.ts

@@ -7,14 +7,6 @@ export function secureHeaders(contentType?: string) {
   };
 }
 
-export function securePluginHeaders() {
-  return {
-    ...SECURITY_HEADERS,
-    "X-Frame-Options": "SAMEORIGIN",
-    "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' wss: ws:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
-  };
-}
-
 const MIME_TYPES: Record<string, string> = {
   ".html": "text/html; charset=utf-8",
   ".css": "text/css; charset=utf-8",

Overlord-Server/src/server/routes/plugin-routes.ts

@@ -1065,9 +1065,9 @@ export async function handlePluginRoutes(
       return new Response(null, { status: 304 });
     }
 
-    return new Response(injected, {
-      headers: { ...deps.secureHeaders("text/html; charset=utf-8"), "Cache-Control": "no-cache", ETag: etag },
-    });
+    const frameHeaders = { ...deps.secureHeaders("text/html; charset=utf-8"), "Cache-Control": "no-cache", ETag: etag };
+    delete (frameHeaders as any)["Content-Security-Policy"];
+    return new Response(injected, { headers: frameHeaders });
   }
 
   const pluginPageMatch = url.pathname.match(/^\/plugins\/([^/]+)$/);
@@ -1166,9 +1166,9 @@ export async function handlePluginRoutes(
   </body>
 </html>`;
 
-    return new Response(html, {
-      headers: { ...deps.secureHeaders("text/html; charset=utf-8"), "Cache-Control": "no-cache", ETag: etag },
-    });
+    const pageHeaders = { ...deps.secureHeaders("text/html; charset=utf-8"), "Cache-Control": "no-cache", ETag: etag };
+    delete (pageHeaders as any)["Content-Security-Policy"];
+    return new Response(html, { headers: pageHeaders });
   }
 
   const pluginAssetMatch = url.pathname.match(/^\/plugins\/([^/]+)\/assets\/(.+)$/);