[pmwiki-users] Want to get "object" style embedding of svg images

[Petko Yotov]

PmWiki includes a Content-Security-Policy (CSP) header that prevents 
resources from being loaded through <object> tags.

You can adapt the header by adding the following to config.php, or 
preferably to Group.php or Group.Page.php if this should apply only to 
specific groups or pages:

   # Override security header to allow local SVG in <object>
   $HTTPHeaders['CSP'] = "Content-Security-Policy: frame-ancestors 
'self'; base-uri 'self'; object-src 'self';";

(Keep the assignment on one line in case this email is reformatted.)

If embedding local SVG files is an intentional feature and users cannot 
upload arbitrary untrusted SVG files, changing the default object-src 
'none' to object-src 'self' is reasonable.

However, SVG and HTML files can contain scripts. If an attacker can 
upload such files and they are served from the wiki's origin, the 
scripts may be able to access same-origin resources, perform 
authenticated actions, or capture form data. Depending on the 
circumstances, this may also expose session information. The risk is not 
limited to <object> or <iframe> embedding: it can also arise when a user 
follows a link to a malicious file that opens directly in the browser. 
This is one reason recent PmWiki versions no longer enable SVG and HTML 
upload extensions by default.

Embedding SVG files through an <img> tag is generally safer because 
browsers disable SVG scripting in that context. However, if a user opens 
the SVG directly in a new tab, its scripts may be able to execute.

If untrusted users can upload SVG files, assess the risks before 
enabling this functionality. Serving such files from a separate origin, 
e.g. images.example.com, or sanitizing them before publication are safer 
approaches.

Petko

-- 
If you upgrade :  https://www.pmwiki.org/Upgrades

On 11/10/2026 04:56, Christopher Cox wrote:
> I know latest pmwiki handles .svg files, but they are done via img.
> 
> I need the interaction provided by embedding the svg as an object.  I 
> played with the old svg.php cookbook and got things so I get (in my 
> case):
> 
> <div id='wikitext'>
> <p><object type="image/svg+xml" 
> data="https://agora-test.example.com/pmwiki/pmwiki.php/Test/Graphviz?action=download&upname=e6226788069aaf8048bbb12f46af77ed.svg" 
> alt="Browser does not support SVG"></object>
> </p>
> 
> Anyway, as is, if I go directly to the url 
> https://agora-test.example.com/pmwiki/pmwiki.php/Test/Graphviz?action=download&upname=e6226788069aaf8048bbb12f46af77ed.svg 
>  from my browser, it works fine.  But on the wiki page, I get nothing.
> 
> Any hints?