From df76a2302a9328613d860a4004cbfdca66e8c3da Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 5 Nov 2024 23:59:37 +0000 Subject: [PATCH] Bug 38365: Proof-of-concept TESTING ONLY --- C4/Output.pm | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/C4/Output.pm b/C4/Output.pm index d8ea0bfb52..a58d818628 100644 --- a/C4/Output.pm +++ b/C4/Output.pm @@ -268,6 +268,29 @@ sub output_with_http_headers { 'Cache-Control' => $cache_policy, 'X-Frame-Options' => 'SAMEORIGIN', }; + + my $csp_header; + my $interface = C4::Context->interface; + if ($interface){ + if ($interface eq 'opac'){ + #NOTE: See BZ 20397 for more information, especially about nonces + #TODO: Replace hard-coded policy with one that can be configured from config file and/or UI + my @csp_options_opac = ( + q#default-src 'self'#, + q#img-src 'self' data:#, + q#style-src 'self' 'unsafe-inline'#, #TODO: remove inline styles from Koha! + ); + $csp_header = join('; ',@csp_options_opac); + } + #TODO: Add header for staff interface + } + + if ($csp_header){ + #TODO: Toggle between "Content-Security-Policy" and "Content-Security-Policy-Report-Only" + #based on system preference ContentSecurityPolicy (None/ReportOnly/Enforce) or koha-conf.xml config + $options->{'Content-Security-Policy-Report-Only'} = $csp_header; + } + $options->{expires} = 'now' if $extra_options->{force_no_caching}; $options->{'Access-Control-Allow-Origin'} = C4::Context->preference('AccessControlAllowOrigin') if C4::Context->preference('AccessControlAllowOrigin'); -- 2.39.5