CSP interaction prevents downloading pdf attachments

[JL710]

Steps to reproduce

1. View a pdf with an attachment
2. go to the attachments tab (top left)
3. click on the attachment

Expected behavior

I am expecting an option to download the attachment. That is how it works when I download the pdf and open if with firefox which also uses pdf.js.

Actual behavior

Just nothing. I click on the attachment and nothing happens.

Server configuration

Nextcloud AIO

Nextcloud version: 30.0.8

I use apache2 as reverse proxy in front of my instance.

Browser

Browser name: Firefox

Browser version: 137.0 (64-bit)

Operating system: Debian

Browser log

This error pops up, when I click on the attachment.

Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-src) at blob:https://mycloudurl.com/65b3b1ae-d9c7-400e-9415-fb4c2e354f72 because it violates the following directive: “frame-src https://www.openstreetmap.org/ 'self' nc: https://mycloudurl.com”

[JL710]

This is an example pdf with a txt attached. test.pdf