|
Lines 24-29
use Koha::Token;
Link Here
|
| 24 |
|
24 |
|
| 25 |
use Koha::Exceptions::Config; |
25 |
use Koha::Exceptions::Config; |
| 26 |
|
26 |
|
|
|
27 |
#NOTE: To cache the nonce, we just use a package level variable, |
| 28 |
#which will be reset after every HTTP request. |
| 29 |
my $cached_nonce; |
| 30 |
|
| 27 |
=head1 NAME |
31 |
=head1 NAME |
| 28 |
|
32 |
|
| 29 |
Koha::ContentSecurityPolicy - Object for handling Content-Security-Policy header |
33 |
Koha::ContentSecurityPolicy - Object for handling Content-Security-Policy header |
|
Lines 192-198
sub get_nonce {
Link Here
|
| 192 |
|
196 |
|
| 193 |
#Koha::Middleware::ContentSecurityPolicy sets an environmental variable |
197 |
#Koha::Middleware::ContentSecurityPolicy sets an environmental variable |
| 194 |
#We cannot use the L1 cache since it is cleared after the middleware is applied |
198 |
#We cannot use the L1 cache since it is cleared after the middleware is applied |
| 195 |
my $env_value = $ENV{CSP_NONCE}; |
199 |
my $env_value = $cached_nonce; |
| 196 |
|
200 |
|
| 197 |
return $env_value; |
201 |
return $env_value; |
| 198 |
} |
202 |
} |
|
Lines 216-225
sub set_nonce {
Link Here
|
| 216 |
#Koha::Middleware::ContentSecurityPolicy sets an environmental variable |
220 |
#Koha::Middleware::ContentSecurityPolicy sets an environmental variable |
| 217 |
#We cannot use the L1 cache since it is cleared after the middleware is applied |
221 |
#We cannot use the L1 cache since it is cleared after the middleware is applied |
| 218 |
if ($nonce) { |
222 |
if ($nonce) { |
| 219 |
$ENV{CSP_NONCE} = $nonce; |
223 |
$cached_nonce = $nonce; |
| 220 |
} else { |
224 |
} else { |
| 221 |
my $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } ); |
225 |
my $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } ); |
| 222 |
$ENV{CSP_NONCE} = $nonce; |
226 |
$cached_nonce = $nonce; |
| 223 |
} |
227 |
} |
| 224 |
return 1; |
228 |
return 1; |
| 225 |
} |
229 |
} |
| 226 |
- |
|
|