Self-host front-end libraries, minimal sign-in header and CSP

Browse Source

- sign-in pages load only what they use (include_login_header.php, ajax_core.js)
- every library, font and data file served from assets/vendor with pinned
  versions (VERSIONS.json); no CDN at runtime
- Content-Security-Policy on app, sign-in and landing pages
- remove httpbin Dropzone target and source-map references

...

This commit is contained in:

Thanakorn

2026-09-24 14:53:41 +07:00

parent 8705be0d1b

commit f11af6e949

105 changed files with 3668 additions and 413 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

app/assets/vendor/bootstrap/5.3.8/bootstrap.min.css

Vendored

+5

File diff suppressed because one or more lines are too long

app/assets/vendor/bootstrap/5.3.8/bootstrap.min.js

Vendored

+6

File diff suppressed because one or more lines are too long