From 22886f9c04762e3f6b1ef80ef0a865fd6525aea4 Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 4 Feb 2026 02:00:44 +0000 Subject: [PATCH] Bug 38365: Fix nonce caching and add to framework plugin scripts Signed-off-by: David Cook --- Koha/ContentSecurityPolicy.pm | 12 ++++++++---- Koha/FrameworkPlugin.pm | 11 +++++++++-- t/Koha/ContentSecurityPolicy.t | 9 +++------ 3 files changed, 20 insertions(+), 12 deletions(-) diff --git a/Koha/ContentSecurityPolicy.pm b/Koha/ContentSecurityPolicy.pm index de17672e813..1e7fc22b133 100644 --- a/Koha/ContentSecurityPolicy.pm +++ b/Koha/ContentSecurityPolicy.pm @@ -183,15 +183,19 @@ sub is_enabled { sub nonce { my ( $self, $nonce ) = @_; - my $cache = Koha::Cache::Memory::Lite->new; + #Koha::Middleware::ContentSecurityPolicy sets an environmental variable + #We cannot use the L1 cache since it is cleared after the middleware is applied + my $env_value = $ENV{CSP_NONCE}; + + #NOTE: This is just used for testing if ($nonce) { - $cache->set_in_cache( 'CSP-NONCE', $nonce ); + $ENV{CSP_NONCE} = $nonce; $self->{nonce} = $nonce; return $self->{nonce}; } - if ( $nonce = $cache->get_from_cache('CSP-NONCE') ) { + if ( $nonce = $env_value ) { $self->{nonce} = $nonce; return $self->{nonce}; } @@ -201,7 +205,7 @@ sub nonce { $self->{nonce} = $nonce; } - $cache->set_in_cache( 'CSP-NONCE', $self->{nonce} ); + $ENV{CSP_NONCE} = $self->{nonce}; return $self->{nonce}; } diff --git a/Koha/FrameworkPlugin.pm b/Koha/FrameworkPlugin.pm index 844957bf0d1..b57f492482a 100644 --- a/Koha/FrameworkPlugin.pm +++ b/Koha/FrameworkPlugin.pm @@ -117,6 +117,7 @@ use Cwd qw//; use base qw(Class::Accessor); use C4::Context; +use Koha::ContentSecurityPolicy; __PACKAGE__->mk_ro_accessors( qw| @@ -137,7 +138,11 @@ __PACKAGE__->mk_ro_accessors( sub new { my ( $class, $params ) = @_; - my $self = $class->SUPER::new(); + my $self = $class->SUPER::new(); + my $csp_nonce = Koha::ContentSecurityPolicy->new->nonce; + if ($csp_nonce) { + $self->{csp_nonce} = $csp_nonce; + } if ( ref($params) eq 'HASH' ) { foreach ( 'name', 'path', 'item_style' ) { $self->{$_} = $params->{$_}; @@ -356,6 +361,8 @@ sub _generate_js { sub _process_javascript { my ( $self, $params, $script ) = @_; + my $csp_nonce = $self->{csp_nonce}; + #remove the script tags; we add them again later $script =~ s/\]*\>\s*(\/\/\\s*)?\<\/script\>//s; @@ -372,7 +379,7 @@ sub _process_javascript { } $self->{noclick} = !$clickfound; $self->{javascript} = < +