fix: add gravatar.com to CSP img-src to allow avatar loading

Author: ddrayko

internal/middleware/security.go

@@ -22,7 +22,7 @@ func SecurityHeaders(next http.Handler) http.Handler {
 		w.Header().Set("X-DNS-Prefetch-Control", "off")
 		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
 		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
-		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https://img.zero-host.org data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://cap.zero-host.org https://cdn.jsdelivr.net; frame-src 'self' blob:; worker-src 'self' blob:; base-uri 'self'")
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https://img.zero-host.org https://www.gravatar.com data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://cap.zero-host.org https://cdn.jsdelivr.net; frame-src 'self' blob:; worker-src 'self' blob:; base-uri 'self'")
 		next.ServeHTTP(w, r)
 	})
 }