This is a similar issue as reported in the closed thread Deck Window Wrong Size , though I don't have a card size slider in the current version. First issue is that the deck window is too small to show the content, the menu is cut off. It shows a vertical scrollbar, but that scrollbar is unusable since the menu disappears when trying to move the mouse to it. Workaround: right click, "inspect element", and set the "#showndecks .adeck" "min-height" property to 250px (up from 125px): (Separately, for decks like this one, it would be nice to have a "sort" option to make it easier to hand-pick specific cards.) Next, in the "choose" window, the cards are very small and their names almost impossible to read: If I resize the window, the scrollable area doesn't get resized. The scrollbar only moves a small subset of the deck window, with a large blank area below: Workarounds: for the broken scrolling, inspect element on the card area, find the parent div.ui-dialog-content.ui-widget-content element, and disable its "height: 327px" property. for the too-small cards, inspect element on a card, and change the ".hand .handcontainer .cardinhand video, .hand .handcontainer .cardinhand img" styles to double the max-width (80px to 160px) and max-height (140px to 280px). Result: Of course, I think it would be nice if the card deck would be more usable out of the box without needing to manually override the styling myself... Session details below, let me know if you want additional info. Profile: <a href="https://app.roll20.net/users/6796560/klaus-w" rel="nofollow">https://app.roll20.net/users/6796560/klaus-w</a> Game: <a href="https://app.roll20.net/campaigns/details/16483767/barovia-curse-of-strahd" rel="nofollow">https://app.roll20.net/campaigns/details/16483767/barovia-curse-of-strahd</a> Browser: Google Chrome 120.0.6099.130 (Official Build) (64-bit) (cohort: Stable) Console output: jquery.migrate.js:20 JQMIGRATE: Logging is active gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:137 Refused to load the script '<a href="https://bat.bing.com/bat.js" rel="nofollow">https://bat.bing.com/bat.js</a>' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-sJUBCWqL1Sp69mEd' 'nonce-PHrEVxmhpSW5Fril' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. Kc @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:137 CAMPAIGN ID: 16483767 vtt.bundle.js:43165 70 vtt.bundle.js:43197 TOUCH SUPPORTED: false vtt.bundle.js:43197 USING WEBGL ACCELERATION... vtt.bundle.js:43197 WEBGL STARTUP SUCCESS vtt.bundle.js:43298 Loading Custom character sheet. vtt.bundle.js:31321 Babylon.js v6.30.0 - WebGL2 - Parallel shader compilation tutorial_tips.js:7 tuts loaded gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:109 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-sJUBCWqL1Sp69mEd' 'nonce-PHrEVxmhpSW5Fril' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-77bgQblnRaKk1m8aq2FHqKiER4ywljc0EoTvK4RBca4='), or a nonce ('nonce-...') is required to enable inline execution. f.aa @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:109 gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:109 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-sJUBCWqL1Sp69mEd' 'nonce-PHrEVxmhpSW5Fril' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-ZdDTEfl8xrGn7iZ/2mMDizDIe6JRmep2vz9STHJi4Zs='), or a nonce ('nonce-...') is required to enable inline execution. f.aa @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:109 14Unsafe attempt to load URL <URL> from frame with URL <URL>. Domains, protocols and ports must match. gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:614 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-sJUBCWqL1Sp69mEd' 'nonce-PHrEVxmhpSW5Fril' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-F/cDWXaljtAzxkboYPXxVpygl3SB04hTtjEOOBtilWA='), or a nonce ('nonce-...') is required to enable inline execution. (anonymous) @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:614 gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:614 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-sJUBCWqL1Sp69mEd' 'nonce-PHrEVxmhpSW5Fril' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-VussMEcsqEPalla4i7RvpHqvRE4+2WmSh4DL2kBzaD4='), or a nonce ('nonce-...') is required to enable inline execution. (anonymous) @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:614 vtt.bundle.js:43298 Including compendium template css. sheetsandboxworker.js:753 Starting up WEB WORKER VM4:209 Roll20 Kingmaker Module log| kScaffold Loaded sheetsandboxworker.js:753 Starting up WEB WORKER sheetsandboxworker.js:753 Starting up WEB WORKER VM4:4 Roll20 Environment: Web vtt.bundle.js:7053 Player -NmqqrCdqeC0zlcpLhDC is offline... vtt.bundle.js:7053 Player -NmyGVfEyQoTV9aeXXe0 is offline... vtt.bundle.js:7053 Player -NmyGn2Wd0DARUwbM93N is offline... vtt.bundle.js:43165 Firebase Online vtt.bundle.js:3471 Scheduled automatic refresh of OAuth token thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.webp:1 Failed to load resource: the server responded with a status of 403 (Forbidden) thumb.jfif:1 Failed to load resource: the server responded with a status of 403 (Forbidden)
