Todos

• The stats pages (/<keyword>+) draw no charts: they load the legacy, unversioned Google Charts loader https://www.google.com/jsapi (YOURLS 1.10.6 includes/functions-html.php:121-125), which the role CSP blocks in script-src-elem, so every inline google.visualization call throws. Measured on /design01+: one CSP console error for jsapi and five google is not defined page errors; the tabs and the click tables still render. The sources tab also requests referrer favicons from the hosts www.google.com (path /s2/favicons) and t0.gstatic.com (path /faviconV2). Options: allow www.google.com and www.gstatic.com in meta/csp.yml (pulls an unpinned third-party script into the admin), replace the charts through a YOURLS plugin, or accept empty chart boxes.

• The notify bar on /admin/index.php never hides: js/jquery.notifybar.js:92 passes a string to setTimeout, which the CSP refuses without unsafe-eval (console: “Evaluating a string as JavaScript violates the following Content Security Policy directive because ‘unsafe-eval’ is not an allowed source of script”). Measured: the bar is still visible 6.5 s after a failed add. Options: an upstream fix to a function callback, or a YOURLS plugin that hides the bar; allowing unsafe-eval is not one.

• At 390 px the admin keeps its fixed desktop layout (#wrap max 950 px, #add-url 400 px, #delete-confirm-dialog 50em wide; body carries desktop from the User-Agent), so the page scrolls sideways and the delete dialog shows its content clipped. Options: responsive rules in a YOURLS plugin or upstream; layout is outside the role stylesheet.