From 9ac88bbbde5260afca0158449ea65b578398e80a Mon Sep 17 00:00:00 2001
From: Robert Bond <Robert.Bond@gov.wales>
Date: Fri, 3 Jul 2026 04:50:47 +0000
Subject: [PATCH] Merged PR 2452: updated csp and params

updated csp and params

Related work items: #23879
---
 components/search/dnssearchresults.js | 2 +-
 middleware.js                         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/search/dnssearchresults.js b/components/search/dnssearchresults.js
index fa59bcf7..c67f21d5 100644
--- a/components/search/dnssearchresults.js
+++ b/components/search/dnssearchresults.js
@@ -899,7 +899,7 @@ const DNSSearchResults = (props) => {
                         <div>
                             <h3>Map Legend</h3>
                             <img
-                                src={`https://datamap.gov.wales/geoserver/ows?service=WMS&request=GetLegendGraphic&format=image/png&height=12&width=12&layer=geonode:${mapLegend}&style=&version=1.3.0&SLD_VERSION=1.1.0&LEGEND_OPTIONS=forceLabels:on&LANGUAGE=${locale}&SCALE=2000000&access_token=n3cRovjblNL1ND9bmzu6S9fupzg3wo`}
+                                src={`https://${locale === "cy" ? "mapdata.llyw.cymru" : "datamap.gov.wales"}/geoserver/ows?service=WMS&request=GetLegendGraphic&format=image/png&height=12&width=12&layer=geonode:${mapTarget}&style=&version=1.3.0&SLD_VERSION=1.1.0&LEGEND_OPTIONS=forceLabels:on&LANGUAGE=${locale}&SCALE=2000000&access_token=n3cRovjblNL1ND9bmzu6S9fupzg3wo`}
                                 width="120%"
                             />
                         </div>
diff --git a/middleware.js b/middleware.js
index dd860e22..185b9205 100644
--- a/middleware.js
+++ b/middleware.js
@@ -9,7 +9,7 @@ export function middleware(request) {
             process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
         };
         style-src 'self' 'unsafe-eval' 'unsafe-inline';
-        img-src 'self' 'unsafe-inline'  https://datamap.gov.wales/  https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com  blob: data: https://img.youtube.com;
+        img-src 'self' 'unsafe-inline'  https://datamap.gov.wales/ https://mapdata.llyw.cymru/ https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com  blob: data: https://img.youtube.com;
         connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
         font-src 'self'  https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
         object-src 'none';