From 790c14bb9f19aab0c798978eeb7ae3f39a52a644 Mon Sep 17 00:00:00 2001 From: David Cook Date: Fri, 31 Oct 2025 04:09:22 +0000 Subject: [PATCH] Bug 38365: add nonce to style-src and add default csp to Debian koha-conf.xml template Signed-off-by: David Cook --- debian/templates/koha-conf-site.xml.in | 16 ++++++++++++++++ etc/koha-conf.xml | 5 +++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in index 0e07af36d8f..5142891ce2a 100644 --- a/debian/templates/koha-conf-site.xml.in +++ b/debian/templates/koha-conf-site.xml.in @@ -497,5 +497,21 @@ __END_SRU_PUBLICSERVER__ 1 + + + + + + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + + + + + + + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + + + diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml index b200810b925..cb80a725f95 100644 --- a/etc/koha-conf.xml +++ b/etc/koha-conf.xml @@ -313,15 +313,16 @@ - default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' - default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + -- 2.39.5