From d1bb824b571ee3fcaeca3bd57eb6c8a4640097ef Mon Sep 17 00:00:00 2001
From: Andras Schmelczer <andras@schmelczer.dev>
Date: Sun, 31 Aug 2025 15:30:15 +0100
Subject: [PATCH] Fix CSP for real

---
 backend/public/index.html |  4 ----
 backend/server.js         | 15 +++++++++++++--
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/backend/public/index.html b/backend/public/index.html
index d45bef3..8dd795a 100644
--- a/backend/public/index.html
+++ b/backend/public/index.html
@@ -4,10 +4,6 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Fizika Admin - Kérdések és képek kezelése</title>
-    <meta
-      http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src https://stats.schmelczer.dev; connect-src https://stats.schmelczer.dev"
-    />
     <script
       defer
       data-domain="fizika.schmelczer.dev"
diff --git a/backend/server.js b/backend/server.js
index 90b1777..97fa052 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -9,7 +9,18 @@ const app = express();
 const PORT = process.env.PORT || 3001;
 
 // Security middleware
-app.use(helmet());
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'", "'unsafe-inline'"],
+      scriptSrc: [
+        "'self'",
+        "https://stats.schmelczer.dev",
+        "'unsafe-inline'",
+      ],
+    },
+  },
+}));
 app.use(cors({
   origin: process.env.FRONTEND_URL || '*',
   credentials: true
@@ -34,7 +45,7 @@ const storage = multer.diskStorage({
 
 const upload = multer({
   storage: storage,
-  limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
+  limits: { fileSize: 50 * 1024 * 1024 }, // 5MB
   fileFilter: (req, file, cb) => {
     if (file.mimetype.startsWith('image/')) {
       cb(null, true);