Revert "Remove custom setting of Content-Security-Policy" only for de…

…velopment

This reverts commit 5f3b5cf (only for development).

config/initializers/content_security_policy.rb

@@ -20,6 +20,9 @@ def host_to_url(str)
 media_host ||= host_to_url(ENV['S3_HOSTNAME']) if ENV['S3_ENABLED'] == 'true'
 media_host ||= assets_host
 
+cloudflarecdn = 'https://cdnjs.cloudflare.com'
+mathjax = 'https://cdn.mathjax.org'
+
 Rails.application.config.content_security_policy do |p|
   p.base_uri        :none
   p.default_src     :none
@@ -35,8 +38,12 @@ def host_to_url(str)
   if Rails.env.development?
     webpacker_urls = %w(ws http).map { |protocol| "#{protocol}#{Webpacker.dev_server.https? ? 's' : ''}://#{Webpacker.dev_server.host_with_port}" }
 
-    p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url, *webpacker_urls
-    p.script_src  :self, :unsafe_inline, :unsafe_eval, assets_host
+    p.font_src    :self, assets_host, cloudflarecdn
+    p.img_src     :self, :https, :data, :blob, assets_host, cloudflarecdn, mathjax
+    p.style_src   :self, :unsafe_inline, assets_host, cloudflarecdn, mathjax
+    p.media_src   :self, :https, :data, assets_host, cloudflarecdn, mathjax
+    p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url, *webpacker_urls, cloudflarecdn, mathjax
+    p.script_src  :self, :unsafe_inline, :unsafe_eval, assets_host, cloudflarecdn, mathjax
     p.child_src   :self, :blob, assets_host
     p.worker_src  :self, :blob, assets_host
   else