Use standalone switch for CSP

Author: pabzm

plugins/help/help.php

@@ -78,7 +78,7 @@ public function action()
             'tablink' => [$this, 'tablink'],
         ]);
 
-        $rcmail->output->set_env('safemode', true);
+        $rcmail->output->csp_allow_remote_ressources = true;
         $rcmail->output->set_env('help_links', $this->help_metadata());
         $rcmail->output->send(!empty($_GET['_content']) ? 'help.content' : 'help.help');
     }

program/actions/mail/compose.php

@@ -683,7 +683,7 @@ public static function prepare_message_body()
         // We can't depend the "safemode" on the message being HTML or not
         // because the user might want to change the editor after loading the
         // page, and then add remote ressources.
-        $rcmail->output->set_env('safemode', true);
+        $rcmail->output->csp_allow_remote_ressources = true;
 
         return $body;
     }

program/actions/settings/identity_edit.php

@@ -75,7 +75,7 @@ public function run($args = [])
             $rcmail->output->send('identityadd');
         }
 
-        $rcmail->output->set_env('safemode', true);
+        $rcmail->output->csp_allow_remote_ressources = true;
         $rcmail->output->send('identityedit');
     }
 

program/actions/settings/response_edit.php

@@ -46,7 +46,7 @@ public function run($args = [])
 
         $rcmail->output->set_pagetitle($title);
         $rcmail->output->set_env('readonly', !empty(self::$response['static']));
-        $rcmail->output->set_env('safemode', true);
+        $rcmail->output->csp_allow_remote_ressources = true;
         $rcmail->output->add_handler('responseform', [$this, 'response_form']);
         $rcmail->output->send('responseedit');
     }

program/include/rcmail_output_html.php

@@ -23,6 +23,7 @@
 class rcmail_output_html extends rcmail_output
 {
     public $type = 'html';
+    public $csp_allow_remote_ressources = false;
 
     protected $message;
     protected $template_name;
@@ -2729,7 +2730,7 @@ protected function add_csp_header(): void
         $csp = $this->get_csp_value('content_security_policy');
         if ($csp !== false) {
             $csp_parts = [$csp];
-            if (isset($this->env['safemode']) && $this->env['safemode'] === true) {
+            if ($this->csp_allow_remote_ressources || (isset($this->env['safemode']) && $this->env['safemode'] === true)) {
                 $csp_allow_remote = $this->get_csp_value('content_security_policy_add_allow_remote');
                 if ($csp_allow_remote !== false) {
                     $csp_parts[] = $csp_allow_remote;