fix: allow loading MathJax JS by adding its hash to CSP

Author: Swiftb0y

netlify.toml

@@ -48,5 +48,5 @@
 [[headers]]
  for = "/news/*"
  [headers.values]
-   # Additionally allow YouTube/Discourse frames and scripts
-    Content-Security-Policy = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-UPkidoMErzWw1gW/eY4LhAi9ZkPch3PP31d6KQoJ6Yc='  'sha256-G40wI6OaLZXCtrb02xUq1H1kEVWjstzoQ0FXKwsWxPw='	https://mixxx.discourse.group/javascripts/embed.js *.discourse-cdn.com; frame-src 'self' https://www.youtube-nocookie.com https://mixxx.discourse.group ; img-src 'self' https://i.ytimg.com ; connect-src 'self' https://mixxx.discourse.group https://*.discourse-cdn.com"
+   # Additionally allow YouTube/Discourse frames and scripts and MathJax
+    Content-Security-Policy = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-UPkidoMErzWw1gW/eY4LhAi9ZkPch3PP31d6KQoJ6Yc='  'sha256-G40wI6OaLZXCtrb02xUq1H1kEVWjstzoQ0FXKwsWxPw='	 'sha256-NoYDhgfdmQGg59XPik/7lIF57F0zlpWNHiB+uKc1Lc8=' https://mixxx.discourse.group/javascripts/embed.js *.discourse-cdn.com cdn.jsdelivr.net; frame-src 'self' https://www.youtube-nocookie.com https://mixxx.discourse.group ; img-src 'self' https://i.ytimg.com ; connect-src 'self' https://mixxx.discourse.group https://*.discourse-cdn.com"

pelicanconf.py

@@ -92,6 +92,8 @@
     "render_math",
 ]
 
+MATH_JAX = {}
+
 
 class MenuItem:
     def __init__(self, url, title, context, css="", children=()):

theme/templates/article.html

@@ -69,4 +69,8 @@ <h4>{% trans %}Comments{% endtrans %}</h4>
 {% if article.comments and article.comments in ("true", "yes") %}
 <script src="{{ SITEURL }}/theme/js/discourse.js"></script>
 {% endif %}
+{% if article.math and article.math in ("true", "yes") %}
+{# mathjax version is pinned for security and version 2.7.9 because pelican-render-math likely doesn't support MathJax 3#}
+<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@2.7.9/config/TeX-AMS-MML_HTMLorMML.js"></script>
+{% endif %}
 {% endblock %}