Org: Fixes CSP for Stripe/Datatrans payments

TYPE: Bugfix
LINK: OGC-2948

Author: Daverball

src/onegov/org/app.py

@@ -555,6 +555,10 @@ def get_theme() -> OrgTheme:
 def org_content_security_policy() -> ContentSecurityPolicy:
     policy = default_content_security_policy()
 
+    policy.script_src.add('https://checkout.stripe.com')
+    policy.script_src.add('https://pay.datatrans.com')
+    policy.script_src.add('https://pay.sandbox.datatrans.com')
+
     policy.child_src.add(SELF)
     policy.child_src.add('https://*.youtube.com')
     policy.child_src.add('https://*.vimeo.com')