From e0e3f0c1410b6e57fd6db765ae2126ea195b232b Mon Sep 17 00:00:00 2001
From: Harvey Kandola <harvey@documize.com>
Date: Fri, 21 Oct 2022 11:12:46 -0400
Subject: [PATCH] Fix middleware for favicon/sitemap

---
 gui/app/index.html   | 1 +
 server/middleware.go | 1 +
 2 files changed, 2 insertions(+)

diff --git a/gui/app/index.html b/gui/app/index.html
index edf0e556..69a82801 100644
--- a/gui/app/index.html
+++ b/gui/app/index.html
@@ -4,6 +4,7 @@
 		{{content-for 'head'}}
 		<meta charset="utf-8">
 		<meta http-equiv="X-UA-Compatible" content="IE=edge">
+		<meta http-equiv=content-security-policy content="default-src *; img-src * 'self' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; style-src 'self' 'unsafe-inline' *;">
 		<title>Documize</title>
 		<meta property="dbname" content="{{.DBname}}" />
 		<meta property="dbhash" content="{{.DBhash}}" />
diff --git a/server/middleware.go b/server/middleware.go
index fc6b3ece..63b3bf19 100644
--- a/server/middleware.go
+++ b/server/middleware.go
@@ -253,6 +253,7 @@ func (m *middleware) preAuthorizeStaticAssets(rt *env.Runtime, r *http.Request)
 		strings.ToLower(r.URL.Path) == "/validate" ||
 		strings.ToLower(r.URL.Path) == "/favicon.ico" ||
 		strings.ToLower(r.URL.Path) == "/robots.txt" ||
+		strings.ToLower(r.URL.Path) == "/sitemap.xml" ||
 		strings.ToLower(r.URL.Path) == "/version" ||
 		strings.HasPrefix(strings.ToLower(r.URL.Path), "/api/public/") ||
 		((rt.Flags.SiteMode == env.SiteModeSetup) && (strings.ToLower(r.URL.Path) == "/api/setup")) {