From 30d154014d38ef8c67b2d3919ed6b5afa26a7657 Mon Sep 17 00:00:00 2001 From: David Cook Date: Fri, 31 Oct 2025 04:09:22 +0000 Subject: [PATCH] Bug 38365: add nonce to style-src and add default csp to Debian koha-conf.xml template Signed-off-by: David Cook --- debian/templates/koha-conf-site.xml.in | 16 ++++++++++++++++ etc/koha-conf.xml | 5 +++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in index 36f632fdb98..e47683e7ca8 100644 --- a/debian/templates/koha-conf-site.xml.in +++ b/debian/templates/koha-conf-site.xml.in @@ -500,5 +500,21 @@ __END_SRU_PUBLICSERVER__ 1 + + + + + + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + + + + + + + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + + + diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml index 0cead511b68..b5d8b99680e 100644 --- a/etc/koha-conf.xml +++ b/etc/koha-conf.xml @@ -316,15 +316,16 @@ - default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' - default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + -- 2.39.5