From cd6cc59239b96ed3ecbe8bbd2a67283c66b24956 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 20 Jan 2026 00:39:34 +0000 Subject: [PATCH] Bug 38365: Add "style-src-attr 'unsafe-inline';" to default policy This change adds "style-src-attr 'unsafe-inline';" to the default CSP policy. The reason is that we have a lot of inline styles throughout Koha, and it will take a long time to clean those up. Also, the WYSIWYG/TinyMCE editor injects inline styles, so it might not be possible to forbid unsafe inline styles in Koha. --- etc/koha-conf.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml index c06780f96a7..10336b9b09d 100644 --- a/etc/koha-conf.xml +++ b/etc/koha-conf.xml @@ -316,14 +316,14 @@ - default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' - default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' -- 2.39.5