From 2b61520524892cc08f095e3019e3918b9cdbf318 Mon Sep 17 00:00:00 2001
From: Krishan <33421343+kfiven@users.noreply.github.com>
Date: Sat, 23 May 2026 21:52:14 +1000
Subject: [PATCH] fix: update CSP to allow reordering rooms inside space (#579)

* fix: update CSP to allow reordering rooms inside space

Fixes https://github.com/cinnyapp/cinny/issues/2949

* disable native dnd in windows configuration

* Disable drag and drop for main webview window in lib.rs

* Remove dragDropEnabled setting from tauri.conf.json

* Replace drag_drop_enabled with disable_drag_drop_handler
---
 src-tauri/src/lib.rs      | 1 +
 src-tauri/tauri.conf.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index b0aab97..e6d5ba4 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -37,6 +37,7 @@ pub fn run() {
             let app_handle = app.handle().clone();
             WebviewWindowBuilder::new(app, "main".to_string(), window_url)
                 .title("Cinny")
+                .disable_drag_drop_handler()
                 .on_new_window(move |url, _features| {
                     let _ = app_handle.opener().open_url(url.as_str(), None::<&str>);
                     NewWindowResponse::Deny
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index f5aa3df..28a8476 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -59,7 +59,7 @@
   },
   "app": {
     "security": {
-      "csp": "default-src 'self' blob: data: filesystem: ws: wss: http: https: tauri:; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: data: filesystem: ws: wss: http: https: tauri:; img-src 'self' data: blob: filesystem: http: https:; connect-src 'self' blob: ipc: ws: wss: http: https: http://ipc.localhost"
+      "csp": "default-src 'self' blob: data: filesystem: ws: wss: http: https: tauri:; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: data: filesystem: ws: wss: http: https: tauri:; style-src 'self' 'unsafe-inline' blob: data: filesystem: http: https:; img-src 'self' data: blob: filesystem: http: https:; connect-src 'self' blob: ipc: ws: wss: http: https: http://ipc.localhost"
     }
   }
 }