View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/etc/koha-conf.xml (-3 / +2 lines)
Lines 316-329 Link Here
316
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
316
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
317
     <csp_mode></csp_mode>
317
     <csp_mode></csp_mode>
318
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
318
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
319
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
319
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
320
   </opac>
320
   </opac>
321
321
322
   <intranet>
322
   <intranet>
323
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
323
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
324
     <csp_mode></csp_mode>
324
     <csp_mode></csp_mode>
325
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
325
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
326
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
326
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
327
   </intranet>
327
   </intranet>
328
 </content_security_policy>
328
 </content_security_policy>
329
329
330
- 

Return to bug 38365