From 5b555d770891471a722443ac6201cca1c32af886 Mon Sep 17 00:00:00 2001
From: Sameh Khamis <sameh@halfpixel.ai>
Date: Fri, 2 Oct 2026 12:00:45 -0700
Subject: [PATCH] Load images the panel redirects to the app's server with CORS

The app treats those images as its own site's and loads them without
CORS, so once they come from the app's server WebGL refuses them and
Cesium stops rendering.
---
 src/tools/globePanel.js | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/tools/globePanel.js b/src/tools/globePanel.js
index c872e4698..219fc27db 100644
--- a/src/tools/globePanel.js
+++ b/src/tools/globePanel.js
@@ -149,7 +149,12 @@ function panelHtml(appOrigin) {
       Object.defineProperty(type.prototype, attribute, {
         ...property,
         set(value) {
-          property.set.call(this, toApp(value));
+          const target = toApp(value);
+          // The app treated the address as its own site; now that it is
+          // another site, images must load with CORS or WebGL refuses them.
+          if (target !== value && 'crossOrigin' in this && this.crossOrigin === null)
+            this.crossOrigin = 'anonymous';
+          property.set.call(this, target);
         },
       });
     }
@@ -184,8 +189,10 @@ function panelHtml(appOrigin) {
           if (node.nodeType !== 1) continue;
           for (const element of [node, ...node.querySelectorAll('[src]')]) {
             const value = element.getAttribute('src');
-            if (value && toApp(value) !== value)
-              element.setAttribute('src', toApp(value));
+            if (!value || toApp(value) === value) continue;
+            if ('crossOrigin' in element && element.crossOrigin === null)
+              element.crossOrigin = 'anonymous';
+            element.setAttribute('src', toApp(value));
           }
         }
       }