Fix tag backgrounds

api/album.go

@@ -52,7 +52,7 @@ func FetchAlbum(albumID string) (Album, error) {
 		return Album{}, err
 	}
 
-	albumCache.Set(albumID + "-album", album, cache.DefaultExpiration)
+	albumCache.Set(albumID+"-album", album, cache.DefaultExpiration)
 	return album, err
 }
 
@@ -72,7 +72,7 @@ func FetchPosts(albumID string) (Album, error) {
 		return Album{}, err
 	}
 
-	albumCache.Set(albumID + "-posts", album, cache.DefaultExpiration)
+	albumCache.Set(albumID+"-posts", album, cache.DefaultExpiration)
 	return album, nil
 }
 
@@ -92,7 +92,7 @@ func FetchMedia(mediaID string) (Album, error) {
 		return Album{}, err
 	}
 
-	albumCache.Set(mediaID + "-media", album, cache.DefaultExpiration)
+	albumCache.Set(mediaID+"-media", album, cache.DefaultExpiration)
 	return album, nil
 }
 
@@ -124,6 +124,7 @@ func ParseAlbum(data gjson.Result) (Album, error) {
 				Tag:          value.Get("tag").String(),
 				Display:      value.Get("display").String(),
 				Background:   "/" + value.Get("background_id").String() + ".webp",
+				BackgroundId: value.Get("background_id").String(),
 			})
 			return true
 		},

api/tag.go

@@ -19,6 +19,7 @@ type Tag struct {
 	PostCount    int64
 	Posts        []Submission
 	Background   string
+	BackgroundId string
 }
 
 var tagCache = cache.New(15*time.Minute, 15*time.Minute)

pages/post.go

@@ -1,6 +1,8 @@
 package pages
 
 import (
+	"crypto/rand"
+	"fmt"
 	"strings"
 
 	"codeberg.org/video-prize-ranch/rimgo/api"
@@ -11,7 +13,6 @@ import (
 func HandlePost(c *fiber.Ctx) error {
 	utils.SetHeaders(c)
 	c.Set("X-Frame-Options", "DENY")
-	c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content")
 
 	post, err := api.Album{}, error(nil)
 	switch {
@@ -41,8 +42,19 @@ func HandlePost(c *fiber.Ctx) error {
 		c.Set("Cache-Control", "public,max-age=31557600")
 	}
 
+	nonce := ""
+	csp := "default-src 'none'; media-src 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content; style-src 'self'"
+	if len(post.Tags) != 0 {
+		b := make([]byte, 8)
+		rand.Read(b)
+		nonce = fmt.Sprintf("%x", b)
+		csp = csp + " 'nonce-" + nonce + "'"
+	}
+	c.Set("Content-Security-Policy", csp)
+
 	return c.Render("post", fiber.Map{
 		"post":     post,
 		"comments": comments,
+		"nonce":    nonce,
 	})
 }

views/post.hbs

@@ -74,9 +74,14 @@
 
     {{#if post.tags}}
     <div class="tags">
+      <style nonce="{{nonce}}">
+        {{#each post.tags}}
+          .{{this.BackgroundId}} { background-image: url('{{this.Background}}') }
+        {{/each}}	      
+      </style>
       {{#each post.tags}}
       <a href="/t/{{this.Tag}}">
-        <div class="tag" style="background-image: url('{{this.Background}}');">
+        <div class="tag {{this.BackgroundId}}">
           <p class="tag__display">{{this.Display}}</p>
         </div>
       </a>