View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/Koha/ContentSecurityPolicy.pm (-2 / +2 lines)
Lines 130-137 sub header_value { Link Here
130
        $csp_nonce = $nonce if defined $nonce;
130
        $csp_nonce = $nonce if defined $nonce;
131
    }
131
    }
132
    if ($csp_nonce) {
132
    if ($csp_nonce) {
133
        $csp_header_value =~ s/_CSP_NONCE_/nonce-$csp_nonce/g;
133
        $csp_header_value =~ s/_CSP_NONCE_/$csp_nonce/g;
134
    } elsif ( $csp_nonce eq '' ) {
134
    } else {
135
        $csp_header_value =~ s/_CSP_NONCE_//g;
135
        $csp_header_value =~ s/_CSP_NONCE_//g;
136
    }
136
    }
137
137
(-)a/etc/koha-conf.xml (-4 / +4 lines)
Lines 312-326 Link Here
312
   <opac>
312
   <opac>
313
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
313
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
314
     <csp_mode></csp_mode>
314
     <csp_mode></csp_mode>
315
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
315
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
316
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
316
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
317
   </opac>
317
   </opac>
318
318
319
   <intranet>
319
   <intranet>
320
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
320
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
321
     <csp_mode></csp_mode>
321
     <csp_mode></csp_mode>
322
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
322
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
323
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
323
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
324
   </intranet>
324
   </intranet>
325
 </content_security_policy>
325
 </content_security_policy>
326
326
(-)a/t/db_dependent/Output.t (-3 / +2 lines)
Lines 236-242 subtest 'Content-Security-Policy tests' => sub { Link Here
236
236
237
                    my $expected_csp_header = $modes->{$mode};
237
                    my $expected_csp_header = $modes->{$mode};
238
                    my $expected_csp_header_value =
238
                    my $expected_csp_header_value =
239
                        "default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'";
239
                        "default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'";
240
                    t::lib::Mocks::mock_config(
240
                    t::lib::Mocks::mock_config(
241
                        'content_security_policy',
241
                        'content_security_policy',
242
                        { $interface => { csp_mode => $mode, csp_header_value => $expected_csp_header_value } }
242
                        { $interface => { csp_mode => $mode, csp_header_value => $expected_csp_header_value } }
Lines 291-297 subtest 'Content-Security-Policy tests' => sub { Link Here
291
291
292
                        my $cache = Koha::Cache::Memory::Lite->get_instance;
292
                        my $cache = Koha::Cache::Memory::Lite->get_instance;
293
                        my $nonce = $cache->get_from_cache("csp_nonce");
293
                        my $nonce = $cache->get_from_cache("csp_nonce");
294
                        $expected_csp_header_value =~ s/_CSP_NONCE_/nonce-$nonce/g;
294
                        $expected_csp_header_value =~ s/_CSP_NONCE_/$nonce/g;
295
                        C4::Output::output_html_with_http_headers( $query, $cookie, $template->output );
295
                        C4::Output::output_html_with_http_headers( $query, $cookie, $template->output );
296
296
297
                        $stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im;
297
                        $stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im;
298
- 

Return to bug 38365