[Jonas Elfering (keulinho)]

1. Why is this change necessary?

Static assets are served directly by the webserver and do not receive application response policies. HTML and SVG should use a consistent policy, scoped so that application-rendered pages and bundled HTML applications keep their existing behavior.

2. What does this change do, exactly?

Update Resources/install-template/htaccess to mark only existing HTML files under media/ and thumbnail/, and send script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'. Apply the same policy to SVG files. Keep the normal PHP rewrite path, bundled HTML applications and application-rendered HTML unchanged.

Images and styles remain permitted. Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions.

3. Describe each step to reproduce the issue or behaviour.

1. Serve an existing HTML file under media/ or thumbnail/, and an SVG file.
2. Check the response for the full CSP above.
3. Open a bundled HTML application or an application-rendered page; its response policy should retain its existing behavior.

Validation: Apache syntax and 15 real HTTP cases pass against this actual template, including subdirectory installation, uppercase extensions, SVG, query strings, bundled HTML and fixture PHP responses. Local Docker HTTP tests; no full installer run.

4. Please link to the relevant issues (if any).

• fix(media): apply CSP to static HTML and SVG assets shopware#21659
• fix(media): align Apache static-asset CSP across recipes recipes#270
• docs(security): document stored asset CSP and CDN requirements docs#2613
• fix(webserver): align static HTML and SVG CSP docker#245
• fix(shopware): align Caddy static-asset CSP helm-charts#330

5. Checklist

• I have tested the changed configuration
• I have checked that rendered HTML and bundled HTML applications retain their behavior
• I have checked whitespace and syntax where applicable
• Complete repository CI before merging

[Soner (shyim)]

we can skip this, the recipes will win