View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/Koha/Template/Plugin/Koha.pm (+13 lines)
Lines 25-30 use C4::Context; Link Here
25
use Koha::Token;
25
use Koha::Token;
26
use Koha;
26
use Koha;
27
use Koha::Cache::Memory::Lite;
27
use Koha::Cache::Memory::Lite;
28
use Koha::ContentSecurityPolicy;
28
29
29
=head1 NAME
30
=head1 NAME
30
31
Lines 162-165 sub GenerateCSRF { Link Here
162
    return $csrf_token;
163
    return $csrf_token;
163
}
164
}
164
165
166
=head3 CSPNonce
167
168
Retrieves the Content-Security-Policy nonce.
169
170
It should be cached by Koha::Middleware::ContentSecurityPolicy.
171
172
=cut
173
174
sub CSPNonce {
175
    return Koha::ContentSecurityPolicy->new->nonce;
176
}
177
165
1;
178
1;
(-)a/t/Koha/Middleware/ContentSecurityPolicy.t (-3 / +10 lines)
Lines 24-34 use Test::NoWarnings; Link Here
24
use Test::More tests => 3;
24
use Test::More tests => 3;
25
use Test::Warn;
25
use Test::Warn;
26
26
27
use File::Basename qw(dirname);
27
use HTTP::Request::Common;
28
use HTTP::Request::Common;
28
use Plack::Builder;
29
use Plack::Builder;
29
use Plack::Util;
30
use Plack::Util;
30
use Plack::Test;
31
use Plack::Test;
31
32
33
use C4::Templates;
34
32
use t::lib::Mocks;
35
use t::lib::Mocks;
33
36
34
use_ok("Koha::Middleware::ContentSecurityPolicy");
37
use_ok("Koha::Middleware::ContentSecurityPolicy");
Lines 50-58 subtest 'test Content-Security-Policy header' => sub { Link Here
50
    # Set nonce
53
    # Set nonce
51
    Koha::ContentSecurityPolicy->new->nonce($test_nonce);
54
    Koha::ContentSecurityPolicy->new->nonce($test_nonce);
52
55
56
    t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' );
57
53
    my $env = {};
58
    my $env = {};
54
    my $app = sub {
59
    my $app = sub {
55
        my $resp = [
60
        require Koha::Plugins;    # this should probably be "use Koha::Plugins;" in C4::Templates instead
61
        my $template = C4::Templates::gettemplate( 'opac-csp.tt', 'opac' );
62
        my $resp     = [
56
            200,
63
            200,
57
            [
64
            [
58
                'Content-Type',
65
                'Content-Type',
Lines 60-66 subtest 'test Content-Security-Policy header' => sub { Link Here
60
                'Content-Length',
67
                'Content-Length',
61
                12
68
                12
62
            ],
69
            ],
63
            [ Koha::ContentSecurityPolicy->new->nonce ]
70
            [ $template->output ]
64
        ];
71
        ];
65
        return $resp;
72
        return $resp;
66
    };
73
    };
Lines 79-85 subtest 'test Content-Security-Policy header' => sub { Link Here
79
        "Response contains Content-Security-Policy header with the expected value"
86
        "Response contains Content-Security-Policy header with the expected value"
80
    );
87
    );
81
    is(
88
    is(
82
        $res->content, $test_nonce,
89
        $res->content, '<script nonce="' . $test_nonce . '">' . "\n" . '</script>' . "\n",
83
        "Response contains generated nonce in the body"
90
        "Response contains generated nonce in the body"
84
    );
91
    );
85
92
(-)a/t/db_dependent/Koha/Template/Plugin/Koha.t (-1 / +22 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 3;
20
use Test::More tests => 4;
21
21
22
use Template::Context;
22
use Template::Context;
23
use Template::Stash;
23
use Template::Stash;
Lines 79-81 subtest 'GenerateCSRF - New CSRF token generated every time we need one' => sub Link Here
79
    $schema->storage->txn_rollback;
79
    $schema->storage->txn_rollback;
80
80
81
};
81
};
82
83
subtest 'CSPNonce' => sub {
84
    plan tests => 1;
85
86
    $schema->storage->txn_begin;
87
88
    my $stash   = Template::Stash->new( { sessionID => $session_id } );
89
    my $context = Template::Context->new( { STASH => $stash } );
90
91
    my $plugin = Koha::Template::Plugin::Koha->new($context);
92
93
    my $csp   = Koha::ContentSecurityPolicy->new;
94
    my $nonce = $csp->nonce;
95
96
    my $token = $plugin->CSPNonce;
97
98
    is( $plugin->CSPNonce, $nonce, 'the correct nonce was provided' );
99
100
    $schema->storage->txn_rollback;
101
102
};
(-)a/t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt (-1 / +2 lines)
Line 0 Link Here
0
- 
1
[% USE raw %][% USE Koha %]<script nonce="[% Koha.CSPNonce | $raw %]">
2
</script>

Return to bug 38365