Draw the map with Leaflet, over OpenStreetMap tiles by default, with the tile source in Server settings #898

New issue

Closed

opened 2026-10-12 14:16:48 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-12 14:16:48 +00:00

Owner

Draw the companies map with Leaflet over OpenStreetMap tiles by default, with the tile source chosen under Server settings: OpenStreetMap, the operator's own tile server, or none.

Why

#700 chose Leaflet 1.9.4, vendored, and decided that a zoomable map exists only when the operator sets a tile source. Nothing has delivered Leaflet since; the map is still the server-written SVG (jobs/views.py CompanyMapView, templates/jobs/company_map.html), and #849, #850, #702 and #703 all wait on it. On 2026-10-12 the maintainer decided to reverse #700's decision 4: OpenStreetMap's public tiles are the default, fetched directly by the browser.

What changes

Leaflet 1.9.4 (BSD-2-Clause) and Leaflet.markercluster 1.5.3 (MIT) vendored through scripts/sync-vendor.mjs with their licences and THIRD-PARTY.md rows; OSV lists no advisory for either (checked 2026-10-12).
Tile source on SiteSettings: osm (default), custom (a URL template and its attribution) or none (the Natural Earth outline drawn by Leaflet, nothing fetched); environment overrides POSTULO_MAP_TILES, POSTULO_MAP_TILE_URL, POSTULO_MAP_TILE_ATTRIBUTION; edited on a Maps settings page under Server settings → Plugins.
The CSP widens on the map page only, and only to the configured tile origin; every other page keeps img-src 'self' data:.
Referer: the site's same-origin Referrer-Policy would strip the Referer OpenStreetMap's tile policy requires, so the tile layer alone sends strict-origin-when-cross-origin (the instance's origin, never a path).
Attribution stays visible on the map; an admin-typed attribution is plain text, because Leaflet's attribution control writes innerHTML.
The list of places stays the page and works with scripts off.
docs/THREAT-MODEL.md says what OpenStreetMap now learns: each viewer's address and the areas they view.

OpenStreetMap tile policy (read 2026-10-12)

Visible "© OpenStreetMap contributors"; a valid Referer; no prefetching or offline use; heavy use may be blocked without notice; avoid hard-coded URLs, which the setting answers.

Done when

The map page draws OpenStreetMap tiles with no CSP violation, the other pages' policy is unchanged, none fetches nothing, a custom origin appears only on the map page's policy, and the browser suite walks the page in both themes.

> Draw the companies map with Leaflet over OpenStreetMap tiles by default, with the tile source chosen under Server settings: OpenStreetMap, the operator's own tile server, or none. ## Why #700 chose Leaflet 1.9.4, vendored, and decided that a zoomable map exists only when the operator sets a tile source. Nothing has delivered Leaflet since; the map is still the server-written SVG (`jobs/views.py` `CompanyMapView`, `templates/jobs/company_map.html`), and #849, #850, #702 and #703 all wait on it. On 2026-10-12 the maintainer decided to **reverse #700's decision 4**: OpenStreetMap's public tiles are the default, fetched directly by the browser. ## What changes - **Leaflet 1.9.4** (BSD-2-Clause) and **Leaflet.markercluster 1.5.3** (MIT) vendored through `scripts/sync-vendor.mjs` with their licences and `THIRD-PARTY.md` rows; OSV lists no advisory for either (checked 2026-10-12). - **Tile source on `SiteSettings`**: `osm` (default), `custom` (a URL template and its attribution) or `none` (the Natural Earth outline drawn by Leaflet, nothing fetched); environment overrides `POSTULO_MAP_TILES`, `POSTULO_MAP_TILE_URL`, `POSTULO_MAP_TILE_ATTRIBUTION`; edited on a *Maps* settings page under *Server settings → Plugins*. - **The CSP widens on the map page only**, and only to the configured tile origin; every other page keeps `img-src 'self' data:`. - **Referer**: the site's `same-origin` Referrer-Policy would strip the Referer OpenStreetMap's tile policy requires, so the tile layer alone sends `strict-origin-when-cross-origin` (the instance's origin, never a path). - **Attribution** stays visible on the map; an admin-typed attribution is plain text, because Leaflet's attribution control writes `innerHTML`. - The list of places stays the page and works with scripts off. - `docs/THREAT-MODEL.md` says what OpenStreetMap now learns: each viewer's address and the areas they view. ## OpenStreetMap tile policy (read 2026-10-12) Visible "© OpenStreetMap contributors"; a valid Referer; no prefetching or offline use; heavy use may be blocked without notice; avoid hard-coded URLs, which the setting answers. ## Done when The map page draws OpenStreetMap tiles with no CSP violation, the other pages' policy is unchanged, *none* fetches nothing, a custom origin appears only on the map page's policy, and the browser suite walks the page in both themes.

tiagoagueda added the

enhancement

interface

security

labels

2026-10-12 14:16:58 +00:00

tiagoagueda referenced this issue

2026-10-12 14:16:58 +00:00

Maps on OpenStreetMap data: choose the engine, the precision and where the tiles come from #700

tiagoagueda referenced this issue

2026-10-12 14:16:59 +00:00

Companies on a map — without telling a tile server where somebody is applying #108