From f37809a40ad1d7b053c3e2a161cccbaa677b2a84 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Mon, 2 Feb 2026 09:59:09 +0000 Subject: [PATCH] Bug 38365: Integrate CSP middleware into Plack apps Add Koha::Middleware::ContentSecurityPolicy to the middleware chain in both app.psgi and the Debian plack.psgi template. Without this integration, the CSP feature would not work - the middleware was created but never activated. This adds it to: - app.psgi (development/git install) - debian/templates/plack.psgi (opac, intranet, and intranet_svc mounts) Signed-off-by: David Cook --- app.psgi | 1 + debian/templates/plack.psgi | 3 +++ 2 files changed, 4 insertions(+) diff --git a/app.psgi b/app.psgi index 05ddb519c2d..75831f4a036 100644 --- a/app.psgi +++ b/app.psgi @@ -56,6 +56,7 @@ builder { enable 'ReverseProxy'; enable '+Koha::Middleware::UserEnv'; enable '+Koha::Middleware::SetEnv'; + enable '+Koha::Middleware::ContentSecurityPolicy'; enable '+Koha::Middleware::RealIP'; sub { diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi index f714769b54e..c5480b51141 100644 --- a/debian/templates/plack.psgi +++ b/debian/templates/plack.psgi @@ -99,6 +99,7 @@ builder { enable 'LogWarn'; } enable "+Koha::Middleware::CSRF"; + enable '+Koha::Middleware::ContentSecurityPolicy'; $opac; }; mount '/intranet' => builder { @@ -119,6 +120,7 @@ builder { enable 'LogWarn'; } enable "+Koha::Middleware::CSRF"; + enable '+Koha::Middleware::ContentSecurityPolicy'; $intranet; }; mount '/intranet_svc' => builder { @@ -127,6 +129,7 @@ builder { enable 'LogWarn'; } enable "+Koha::Middleware::CSRF"; + enable '+Koha::Middleware::ContentSecurityPolicy'; $intranet_svc; }; mount '/api/v1/app.pl' => builder { -- 2.39.5