From 62f0bac3813b3bc58ddb72f6846da473c3060f5e Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Sun, 11 Feb 2024 18:08:27 +0100
Subject: [PATCH] Allow CSP connect-src CORS for keys.openpgp.org to directly
 fetch PGP keys

---
 dev/View/Popup/OpenPgpImport.js               | 25 ++++++++++++++++++-
 .../app/libraries/snappymail/http/csp.php     |  1 +
 .../Views/User/PopupsOpenPgpImport.html       |  1 -
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/dev/View/Popup/OpenPgpImport.js b/dev/View/Popup/OpenPgpImport.js
index a26291178..a59378fc8 100644
--- a/dev/View/Popup/OpenPgpImport.js
+++ b/dev/View/Popup/OpenPgpImport.js
@@ -32,7 +32,7 @@ export class OpenPgpImportPopupView extends AbstractViewPopup {
 
 	searchPGP() {
 		this.key(i18n('SUGGESTIONS/SEARCHING_DESC'));
-		Remote.request('SearchPGPKey',
+		const fn = () => Remote.request('SearchPGPKey',
 			(iError, oData) => {
 				if (iError) {
 					this.key(oData.ErrorMessage);
@@ -43,6 +43,29 @@ export class OpenPgpImportPopupView extends AbstractViewPopup {
 				query: this.search()
 			}
 		);
+		fetch(
+			`https://keys.openpgp.org/pks/lookup?op=get&options=mr&search=${this.search()}`,
+			{
+				method: 'GET',
+				mode: 'cors',
+				cache: 'no-cache',
+				redirect: 'error',
+				referrerPolicy: 'no-referrer',
+				credentials: 'omit'
+			}
+		)
+		.then(response => {
+			if ('application/pgp-keys' == response.headers.get('Content-Type')) {
+				response.text().then(body => this.key(body));
+			} else {
+				fn();
+			}
+		})
+		.catch(e => {
+			this.key('keys.openpgp.org: ' + e?.message + '\nTrying local...');
+			fn();
+			throw e;
+		});
 	}
 
 	submitForm() {
diff --git a/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php b/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
index 33b16ab7b..f014c33d0 100755
--- a/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
+++ b/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
@@ -27,6 +27,7 @@ class CSP
 		'img-src' => ["'self'", 'data:'],
 		'media-src' => ["'self'", 'data:'],
 		'style-src' => ["'self'", "'unsafe-inline'"],
+		'connect-src' => ["'self'", "keys.openpgp.org"]
 	];
 
 	function __construct(string $default = '')
diff --git a/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpImport.html b/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpImport.html
index 46ca374e0..c90fb4d73 100644
--- a/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpImport.html
+++ b/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpImport.html
@@ -20,7 +20,6 @@
 				value: saveServer
 			}
 		}"></div>
-		<br>
 		<div data-bind="visible: canGnuPG, component: {
 			name: 'Checkbox',
 			params: {