View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/debian/templates/koha-conf-site.xml.in (-2 / +2 lines)
Lines 553-566 __END_SRU_PUBLICSERVER__ Link Here
553
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
553
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
554
     <csp_mode></csp_mode>
554
     <csp_mode></csp_mode>
555
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
555
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
556
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
556
     <csp_header_value></csp_header_value>
557
   </opac>
557
   </opac>
558
558
559
   <intranet>
559
   <intranet>
560
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
560
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
561
     <csp_mode></csp_mode>
561
     <csp_mode></csp_mode>
562
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
562
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
563
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
563
     <csp_header_value></csp_header_value>
564
   </intranet>
564
   </intranet>
565
 </content_security_policy>
565
 </content_security_policy>
566
566
(-)a/etc/koha-conf.xml (-3 / +2 lines)
Lines 364-377 Link Here
364
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
364
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
365
     <csp_mode></csp_mode>
365
     <csp_mode></csp_mode>
366
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
366
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
367
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
367
     <csp_header_value></csp_header_value>
368
   </opac>
368
   </opac>
369
369
370
   <intranet>
370
   <intranet>
371
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
371
     <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
372
     <csp_mode></csp_mode>
372
     <csp_mode></csp_mode>
373
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
373
     <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
374
     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
374
     <csp_header_value></csp_header_value>
375
   </intranet>
375
   </intranet>
376
 </content_security_policy>
376
 </content_security_policy>
377
377
378
- 

Return to bug 38365