Page MenuHomePhabricator

Mailman3 tries to load Google Fonts, but blocked by CSP
Closed, ResolvedPublic

Description

Visiting https://lists-next.wikimedia.org/hyperkitty/list/test@lists-next.wikimedia.org/thread/RM2QKJBHWVE3LSZVRT2STY5DKVCCAJ3G/

Content Security Policy: The page’s settings blocked the loading of a resource at https://fonts.gstatic.com/s/droidsans/v6/s-BiyweUPV0v-yRb-cjciC3USBnSvpkopQaUR-2r7iU.ttf (“default-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at https://fonts.gstatic.com/s/droidsansmono/v7/ns-m2xQYezAtqh7ai59hJYW_AySPyikQrZReizgrnuw.ttf (“default-src”).

Yay for CSP, but still a problem (and should be reported upstream?). This is fallout from T278905: Reconsider which mailman3 version we're running.

Event Timeline

Legoktm triaged this task as High priority.Tue, Apr 27, 4:40 AM
Legoktm created this task.

https://lists-next.wikimedia.org/mailman3/static/CACHE/css/54a97321b5f1.css

@font-face {
  font-family: 'Droid Sans';
  font-style: normal;
  font-weight: 400;
  src: local('Droid Sans'), local('DroidSans'),
       url(https://fonts.gstatic.com/s/droidsans/v6/s-BiyweUPV0v-yRb-cjciC3USBnSvpkopQaUR-2r7iU.ttf) format('truetype'),
       url(/mailman3/static/hyperkitty/libs/fonts/droid/DroidSans.ttf?9a88e405c18d) format('truetype');
}
@font-face {
  font-family: 'Droid Sans Mono';
  font-style: normal;
  font-weight: 400;
  src: local('Droid Sans Mono'), local('DroidSansMono'),
       url(https://fonts.gstatic.com/s/droidsansmono/v7/ns-m2xQYezAtqh7ai59hJYW_AySPyikQrZReizgrnuw.ttf) format('truetype'),
       url(/mailman3/static/hyperkitty/libs/fonts/droid/DroidSansMono.ttf?9a88e405c18d) format('truetype');
}

http://lists-next.wikimedia.org/mailman3/static/hyperkitty/libs/fonts/droid/DroidSans.ttf?9a88e405c18d exists so it's loading from Google for no reason...

Mentioned in SAL (#wikimedia-operations) [2021-04-27T05:27:25Z] <legoktm> imported hyperkitty_1.3.4-2~bpo10+2 to apt.wm.o (T281213)

I installed the new package, but I guess there's some command I need to run to force it to regenerate the CSS?

Legoktm claimed this task.

Also filed in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987654

I installed the new package, but I guess there's some command I need to run to force it to regenerate the CSS?

sudo mailman-web collectstatic --clear && sudo mailman-web compress && sudo systemctl restart mailman3-web (will document this)

This also fixed the postorius bug, yay.