View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/debian/templates/koha-conf-site.xml.in (+16 lines)
Lines 500-504 __END_SRU_PUBLICSERVER__ Link Here
500
   <parallel_loops_count>1</parallel_loops_count>
500
   <parallel_loops_count>1</parallel_loops_count>
501
 </auto_renew_cronjob>
501
 </auto_renew_cronjob>
502
502
503
 <content_security_policy>
504
   <opac>
505
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
506
     <csp_mode></csp_mode>
507
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
508
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
509
   </opac>
510
511
   <intranet>
512
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
513
     <csp_mode></csp_mode>
514
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
515
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
516
   </intranet>
517
 </content_security_policy>
518
503
</config>
519
</config>
504
</yazgfs>
520
</yazgfs>
(-)a/etc/koha-conf.xml (-3 / +3 lines)
Lines 316-330 Link Here
316
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
316
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
317
     <csp_mode></csp_mode>
317
     <csp_mode></csp_mode>
318
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
318
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
319
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
319
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
320
   </opac>
320
   </opac>
321
321
322
   <intranet>
322
   <intranet>
323
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
323
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
324
     <csp_mode></csp_mode>
324
     <csp_mode></csp_mode>
325
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
325
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
326
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
326
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
327
   </intranet>
327
   </intranet>
328
 </content_security_policy>
328
 </content_security_policy>
329
329
</config>
330
</config>
330
</yazgfs>
331
</yazgfs>
331
- 

Return to bug 38365