View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/debian/templates/koha-conf-site.xml.in (+16 lines)
Lines 497-501 __END_SRU_PUBLICSERVER__ Link Here
497
   <parallel_loops_count>1</parallel_loops_count>
497
   <parallel_loops_count>1</parallel_loops_count>
498
 </auto_renew_cronjob>
498
 </auto_renew_cronjob>
499
499
500
 <content_security_policy>
501
   <opac>
502
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
503
     <csp_mode></csp_mode>
504
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
505
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
506
   </opac>
507
508
   <intranet>
509
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
510
     <csp_mode></csp_mode>
511
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
512
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
513
   </intranet>
514
 </content_security_policy>
515
500
</config>
516
</config>
501
</yazgfs>
517
</yazgfs>
(-)a/etc/koha-conf.xml (-3 / +3 lines)
Lines 313-327 Link Here
313
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
313
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
314
     <csp_mode></csp_mode>
314
     <csp_mode></csp_mode>
315
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
315
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
316
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
316
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
317
   </opac>
317
   </opac>
318
318
319
   <intranet>
319
   <intranet>
320
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
320
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
321
     <csp_mode></csp_mode>
321
     <csp_mode></csp_mode>
322
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
322
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
323
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
323
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
324
   </intranet>
324
   </intranet>
325
 </content_security_policy>
325
 </content_security_policy>
326
326
</config>
327
</config>
327
</yazgfs>
328
</yazgfs>
328
- 

Return to bug 38365