Bugzilla – Attachment 194479 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports
Bug-38365-Set-webpacknonce-for-style-loader-plugin.patch (text/plain), 8.08 KB, created by
David Cook
on 2026-03-05 05:54:27 UTC
(
hide
)
Description:
Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-03-05 05:54:27 UTC
Size:
8.08 KB
patch
obsolete
>From ffb322ba90eec84c5313e81cfc28d7631ec82f98 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Thu, 5 Mar 2026 05:39:03 +0000 >Subject: [PATCH] Bug 38365: Set __webpack_nonce__ for style-loader plugin and > fix fontawesome imports > >By setting __webpack_nonce__ webpack/rspack will add the nonce to styles >added using style-loader plugin. > >Also, stop fontawesome from auto injecting CSS elements, and instead >manually import them so that they can be picked up by style-loader >--- > .../prog/en/includes/doc-head-close.inc | 3 ++ > .../intranet-tmpl/prog/js/vue/csp-nonce.js | 1 + > .../prog/js/vue/modules/acquisitions.ts | 4 ++- > .../js/vue/modules/admin/record_sources.ts | 4 ++- > .../intranet-tmpl/prog/js/vue/modules/erm.ts | 4 ++- > .../prog/js/vue/modules/preservation.ts | 4 ++- > .../intranet-tmpl/prog/js/vue/modules/sip2.ts | 4 ++- > rspack.config.js | 36 ++++++++++++++----- > 8 files changed, 47 insertions(+), 13 deletions(-) > create mode 100644 koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >index 3f2b44676f9..a5ab7d6652f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >@@ -8,6 +8,9 @@ > <meta name="viewport" content="width=device-width, initial-scale=1" /> > <meta name="csrf-token" content="[% Koha.GenerateCSRF | $raw %]" /> > [% IF logged_in_user %]<meta name="generator" content="Koha [% Koha.Version.maintenance | html %]" />[% END %] >+<script nonce="[% Koha.CSPNonce | $raw %]"> >+ window.__CSP_NONCE__ = "[% Koha.CSPNonce | $raw %]"; >+</script> > [%# Prevent XFS attacks -%] > [% UNLESS popup %] > <style nonce="[% Koha.CSPNonce | $raw %]" id="antiClickjack"> >diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js b/koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js >new file mode 100644 >index 00000000000..aa73dedef09 >--- /dev/null >+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js >@@ -0,0 +1 @@ >+__webpack_nonce__ = window.__CSP_NONCE__; >diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/acquisitions.ts b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/acquisitions.ts >index 5981457ae75..c497c5296d7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/acquisitions.ts >+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/acquisitions.ts >@@ -2,7 +2,9 @@ import { createApp } from "vue"; > import { createWebHistory, createRouter } from "vue-router"; > import { createPinia } from "pinia"; > >-import { library } from "@fortawesome/fontawesome-svg-core"; >+import { config, library } from "@fortawesome/fontawesome-svg-core"; >+config.autoAddCss = false; >+import "@fortawesome/fontawesome-svg-core/styles.css"; > import { > faEye, > faEyeSlash, >diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/admin/record_sources.ts b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/admin/record_sources.ts >index adbe680d649..40e2baaf4df 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/admin/record_sources.ts >+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/admin/record_sources.ts >@@ -2,7 +2,9 @@ import { createApp } from "vue"; > import { createPinia } from "pinia"; > import { createWebHistory, createRouter } from "vue-router"; > >-import { library } from "@fortawesome/fontawesome-svg-core"; >+import { config, library } from "@fortawesome/fontawesome-svg-core"; >+config.autoAddCss = false; >+import "@fortawesome/fontawesome-svg-core/styles.css"; > import { > faPlus, > faMinus, >diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/erm.ts b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/erm.ts >index 614f0dc7249..d7b21be7fc5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/erm.ts >+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/erm.ts >@@ -2,7 +2,9 @@ import { createApp } from "vue"; > import { createWebHistory, createRouter } from "vue-router"; > import { createPinia } from "pinia"; > >-import { library } from "@fortawesome/fontawesome-svg-core"; >+import { config, library } from "@fortawesome/fontawesome-svg-core"; >+config.autoAddCss = false; >+import "@fortawesome/fontawesome-svg-core/styles.css"; > import { > faList, > faPlus, >diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/preservation.ts b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/preservation.ts >index 38775b6581e..1b142d59763 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/preservation.ts >+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/preservation.ts >@@ -2,7 +2,9 @@ import { createApp } from "vue"; > import { createWebHistory, createRouter } from "vue-router"; > import { createPinia } from "pinia"; > >-import { library } from "@fortawesome/fontawesome-svg-core"; >+import { config, library } from "@fortawesome/fontawesome-svg-core"; >+config.autoAddCss = false; >+import "@fortawesome/fontawesome-svg-core/styles.css"; > import { > faPlus, > faMinus, >diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/sip2.ts b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/sip2.ts >index 6188354556f..4e095a43e35 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/vue/modules/sip2.ts >+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/modules/sip2.ts >@@ -2,7 +2,9 @@ import { createApp } from "vue"; > import { createWebHistory, createRouter } from "vue-router"; > import { createPinia } from "pinia"; > >-import { library } from "@fortawesome/fontawesome-svg-core"; >+import { config, library } from "@fortawesome/fontawesome-svg-core"; >+config.autoAddCss = false; >+import "@fortawesome/fontawesome-svg-core/styles.css"; > import { > faPlus, > faMinus, >diff --git a/rspack.config.js b/rspack.config.js >index 62cf6b1956c..de8cc2e9d98 100644 >--- a/rspack.config.js >+++ b/rspack.config.js >@@ -19,15 +19,30 @@ module.exports = [ > }, > }, > entry: { >- erm: "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/erm.ts", >- preservation: >+ erm: [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/erm.ts", >+ ], >+ preservation: [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", > "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/preservation.ts", >- "admin/record_sources": >+ ], >+ "admin/record_sources": [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", > "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/admin/record_sources.ts", >- acquisitions: >+ ], >+ acquisitions: [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", > "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/acquisitions.ts", >- islands: "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/islands.ts", >- sip2: "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/sip2.ts", >+ ], >+ islands: [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/islands.ts", >+ ], >+ sip2: [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/sip2.ts", >+ ], > }, > output: { > filename: "[name].js", >@@ -102,7 +117,10 @@ module.exports = [ > outputModule: true, > }, > entry: { >- islands: "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/islands.ts", >+ islands: [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/modules/islands.ts", >+ ], > }, > output: { > filename: "[name].esm.js", >@@ -169,8 +187,10 @@ module.exports = [ > }, > { > entry: { >- "api-client.cjs": >+ "api-client.cjs": [ >+ "./koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js", > "./koha-tmpl/intranet-tmpl/prog/js/fetch/api-client.js", >+ ], > }, > devtool: false, > output: { >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968
|
194374
|
194422
|
194423
|
194424
|
194425
|
194426
|
194427
|
194428
|
194440
|
194441
|
194448
|
194449
|
194477
|
194478
|
194479
|
194567
|
194569
|
194570
|
194571
|
194572
|
194573
|
194574
|
194575
|
194576
|
194577
|
194578
|
194579
|
194580
|
194581
|
194582
|
194583
|
194584
|
194585
|
194586
|
194587
|
194588
|
194589
|
194590
|
194591
|
194592
|
194593
|
194594
|
194595
|
194596
|
194597
|
194598
|
194599
|
194600
|
194601
|
194602
|
194603
|
194604
|
194605
|
194606
|
194607
|
194608
|
194609
|
194610