View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/Koha/ContentSecurityPolicy.pm (-4 / +7 lines)
Lines 24-29 use Koha::Token; Link Here
24
24
25
use Koha::Exceptions::Config;
25
use Koha::Exceptions::Config;
26
26
27
#NOTE: To cache the nonce, we just use a package level variable,
28
#which will be reset after every HTTP request.
29
my $cached_nonce;
30
27
=head1 NAME
31
=head1 NAME
28
32
29
Koha::ContentSecurityPolicy - Object for handling Content-Security-Policy header
33
Koha::ContentSecurityPolicy - Object for handling Content-Security-Policy header
Lines 192-198 sub get_nonce { Link Here
192
196
193
    #Koha::Middleware::ContentSecurityPolicy sets an environmental variable
197
    #Koha::Middleware::ContentSecurityPolicy sets an environmental variable
194
    #We cannot use the L1 cache since it is cleared after the middleware is applied
198
    #We cannot use the L1 cache since it is cleared after the middleware is applied
195
    my $env_value = $ENV{CSP_NONCE};
199
    my $env_value = $cached_nonce;
196
200
197
    return $env_value;
201
    return $env_value;
198
}
202
}
Lines 216-225 sub set_nonce { Link Here
216
    #Koha::Middleware::ContentSecurityPolicy sets an environmental variable
220
    #Koha::Middleware::ContentSecurityPolicy sets an environmental variable
217
    #We cannot use the L1 cache since it is cleared after the middleware is applied
221
    #We cannot use the L1 cache since it is cleared after the middleware is applied
218
    if ($nonce) {
222
    if ($nonce) {
219
        $ENV{CSP_NONCE} = $nonce;
223
        $cached_nonce = $nonce;
220
    } else {
224
    } else {
221
        my $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } );
225
        my $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } );
222
        $ENV{CSP_NONCE} = $nonce;
226
        $cached_nonce = $nonce;
223
    }
227
    }
224
    return 1;
228
    return 1;
225
}
229
}
226
- 

Return to bug 38365