From 48c9234545ed5a20e79ad16c1fb103e58916ce04 Mon Sep 17 00:00:00 2001
From: Daniel <daniel.betz@daniel-betz.com>
Date: Wed, 23 Jan 2019 17:13:11 +0100
Subject: [PATCH] FIX: Lazy Loading: copy only present srcset

When showing a lazy-loaded image, copy the `srcset` property only when
it is actually set. `copyImg.srcset = copyImg.srcset` is not actually a
noop but creates an empty `srcset`, changing content security rules on
the image.
---
 app/assets/javascripts/discourse/lib/lazy-load-images.js.es6 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/discourse/lib/lazy-load-images.js.es6 b/app/assets/javascripts/discourse/lib/lazy-load-images.js.es6
index 58c229850cf..4be70c109c9 100644
--- a/app/assets/javascripts/discourse/lib/lazy-load-images.js.es6
+++ b/app/assets/javascripts/discourse/lib/lazy-load-images.js.es6
@@ -45,7 +45,10 @@ function show(image) {
     };
 
     copyImg.src = imageData.src;
-    copyImg.srcset = imageData.srcset || copyImg.srcset;
+
+    if (imageData.srcset) {
+      copyImg.srcset = imageData.srcset;
+    }
 
     copyImg.style.position = "absolute";
     copyImg.style.top = `${image.offsetTop}px`;