View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/debian/templates/koha-conf-site.xml.in (-2 / +2 lines)
Lines 505-518 __END_SRU_PUBLICSERVER__ Link Here
505
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
505
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
506
     <csp_mode></csp_mode>
506
     <csp_mode></csp_mode>
507
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
507
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
508
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
508
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
509
   </opac>
509
   </opac>
510
510
511
   <intranet>
511
   <intranet>
512
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
512
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
513
     <csp_mode></csp_mode>
513
     <csp_mode></csp_mode>
514
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
514
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used placeholder for the generated CSP nonce. -->
515
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
515
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
516
   </intranet>
516
   </intranet>
517
 </content_security_policy>
517
 </content_security_policy>
518
518
(-)a/etc/koha-conf.xml (-3 / +2 lines)
Lines 316-329 Link Here
316
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
316
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
317
     <csp_mode></csp_mode>
317
     <csp_mode></csp_mode>
318
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
318
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
319
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
319
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
320
   </opac>
320
   </opac>
321
321
322
   <intranet>
322
   <intranet>
323
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
323
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
324
     <csp_mode></csp_mode>
324
     <csp_mode></csp_mode>
325
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
325
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
326
     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
326
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
327
   </intranet>
327
   </intranet>
328
 </content_security_policy>
328
 </content_security_policy>
329
329
330
- 

Return to bug 38365