From c892b18d3317bb06665e25947f3579ef40b24a2f Mon Sep 17 00:00:00 2001
From: canglan <admin@sea-studio.top>
Date: Wed, 15 Jul 2026 03:58:16 +0800
Subject: [PATCH] fix: CSP script-src-attr:none blocked all onclick handlers
 since day 1

---
 backend/server.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/server.js b/backend/server.js
index ddb6b41..d2cdbc9 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -42,6 +42,7 @@ app.use(helmet({
       imgSrc: ["'self'", "data:", "blob:"],
       mediaSrc: ["'self'"],
       connectSrc: ["'self'"],
+      scriptSrcAttr: null,
     },
   },
   crossOriginEmbedderPolicy: false,