From d40ec59de8f83ceb55fdca8b14cc6bc966852985 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 20 Jan 2026 00:39:34 +0000 Subject: [PATCH] Bug 38365: Add "style-src-attr 'unsafe-inline';" to default policy This change adds "style-src-attr 'unsafe-inline';" to the default CSP policy. The reason is that we have a lot of inline styles throughout Koha, and it will take a long time to clean those up. Also, the WYSIWYG/TinyMCE editor injects inline styles, so it might not be possible to forbid unsafe inline styles in Koha. Signed-off-by: David Cook Signed-off-by: Martin Renvoize --- debian/templates/koha-conf-site.xml.in | 4 ++-- etc/koha-conf.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in index 92070967eb0..03fbba33170 100644 --- a/debian/templates/koha-conf-site.xml.in +++ b/debian/templates/koha-conf-site.xml.in @@ -505,14 +505,14 @@ __END_SRU_PUBLICSERVER__ - default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' - default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml index c06780f96a7..10336b9b09d 100644 --- a/etc/koha-conf.xml +++ b/etc/koha-conf.xml @@ -316,14 +316,14 @@ - default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' - default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' -- 2.52.0