From faa7e2671688f5f46c098bec87c1e948f9f45944 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Mon, 2 Feb 2026 10:14:28 +0000 Subject: [PATCH] Bug 38365: Add CSP nonces to all inline script tags Content Security Policy (CSP) blocks inline scripts by default to prevent XSS attacks. To allow legitimate inline scripts to execute, each [% END %] - - [% IF lang && lang != 'en' %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc index 382f64ef5b1..8dfbfdabf28 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc @@ -6,7 +6,7 @@ [% Asset.js("lib/bootstrap/bootstrap.bundle.min.js") | $raw %] [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %] - - @@ -51,7 +51,7 @@ [% END %] [% IF Koha.Preference('AudioAlerts') || AudioAlertsPage %] - [% END %] - [% IF ( PatronAutoComplete ) %] -
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc index fc5b1da4a4e..18265cc46d0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc @@ -85,7 +85,7 @@
[% SET islands = Asset.js("js/vue/dist/islands.esm.js").match('(src="([^"]+)")').1 %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc index 31d78115288..f7954be5cdd 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc @@ -46,7 +46,7 @@ [% END %] [% BLOCK 'modal-claims-js' %] - [% END %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc index 08626ea6cae..0dc59437e6c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc @@ -1,5 +1,5 @@ - diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc index 678ed1f6bce..f604e631604 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc @@ -1,5 +1,5 @@ - [% Asset.js("js/acquisitions-menu.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt index bae154948a0..599f063b5ee 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt @@ -1276,7 +1276,7 @@ [% INCLUDE 'datatables.inc' %] [% Asset.js("js/acq.js") | $raw %] [% INCLUDE 'calendar.inc' %] - [% UNLESS ( closedate ) %] - [% ELSE %] - [% END # /UNLESS (closedate) %] - [% END %] [% IF ( bookselleridfrom ) %] - [% Asset.js("js/vue/dist/acquisitions.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt index 4b7acc6314f..cb074b8ed6c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt @@ -331,7 +331,7 @@ [% INCLUDE 'datatables.inc' %] [% INCLUDE 'z3950_search.inc' %] [% Asset.js("js/z3950_search.js") | $raw %] - [% Asset.js("js/biblio_framework.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt index 00787368b8a..aea291e11ab 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt @@ -134,7 +134,7 @@ [% MACRO jsinclude BLOCK %] [% Asset.js("js/admin-menu.js") | $raw %] [% INCLUDE 'datatables.inc' %] - @@ -872,7 +872,7 @@ [% INCLUDE 'calendar.inc' %] [% INCLUDE 'datatables.inc' %] [% INCLUDE 'select2.inc' %] - [% Asset.js("js/categories.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt index 18267ea53b4..ba27b27863f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt @@ -204,7 +204,7 @@ [% MACRO jsinclude BLOCK %] [% Asset.js("js/admin-menu.js") | $raw %] [% INCLUDE 'datatables.inc' %] - [% Asset.js("js/marc_subfields_structure.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt index 12c7bb6fe8f..074e951b2db 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt @@ -330,7 +330,7 @@ [% MACRO jsinclude BLOCK %] [% INCLUDE 'datatables.inc' %] [% Asset.js("js/admin-menu.js") | $raw %] - [% END %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt index 1809a110cef..fb12d72d7f8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt @@ -40,7 +40,7 @@ [%- END -%] [% END %] [% MACRO jsinclude BLOCK %] - [% Asset.js("js/authorities.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt index bc0b357e48b..57e616e0aa7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt @@ -16,7 +16,7 @@ > [% INCLUDE 'doc-head-close.inc' %] [% INCLUDE 'select2.inc' %] - [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] [% Asset.js("js/cataloging.js") | $raw %] - @@ -142,7 +142,7 @@ [% IF ( displayhierarchy ) %] [% Asset.js("lib/jquery/plugins/jstree/jstree-3.3.12.min.js") | $raw %] [% END %] - [% Asset.js("js/authorities.js") | $raw %] [% Asset.js("js/merge-record.js") | $raw %] - [% Asset.js("js/auth-finder-search.js") | $raw %] [% Asset.js("js/authorities-detail-modal.js") | $raw %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt index 0f0103f2ed3..1558114f4b8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt @@ -56,17 +56,17 @@ [% INCLUDE 'js-date-format.inc' %] [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] - - [% Asset.js("js/modals/place_booking.js") | $raw %] [% Asset.js("js/cancel_booking_modal.js") | $raw %] [% Asset.js("js/combobox.js") | $raw %] [% Asset.js("js/additional-filters.js") | $raw %] - - [% Asset.js("js/catalog.js") | $raw %] @@ -92,13 +92,13 @@ [% Asset.js("js/browser.js") | $raw %] [% IF ( Koha.Preference('CatalogConcerns') ) %] - [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] [% END %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt index 66a5774709d..6a12ccf5cd7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt @@ -200,10 +200,10 @@ [% Asset.js("lib/dayjs/dayjs.min.js") | $raw %] [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] - - [% Asset.js("js/catalog.js") | $raw %] @@ -216,13 +216,13 @@ [% Asset.js("js/browser.js") | $raw %] [% IF ( Koha.Preference('CatalogConcerns') ) %] - [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] [% END %] - [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] [% END %] [% IF ( ( Koha.Preference('CatalogConcerns') || Koha.Preference('OpacCatalogConcerns') ) && CAN_user_editcatalogue_edit_catalogue ) %] - [% Asset.js("js/modals/display_ticket.js") | $raw %] [% END # /IF CatalogConcerns %] - - [% INCLUDE 'js-biblio-format.inc' %] @@ -1761,7 +1761,7 @@ [% IF Koha.Preference('EnableBooking') %] [% Asset.js("js/modals/place_booking.js") | $raw %] [% END %] - - [% Asset.js("js/catalog.js") | $raw %] @@ -145,13 +145,13 @@ [% END %] [% IF ( Koha.Preference('CatalogConcerns') ) %] - [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] [% END %] - - [% Asset.js("js/catalog.js") | $raw %] @@ -105,13 +105,13 @@ [% END %] [% IF ( Koha.Preference('CatalogConcerns') ) %] - [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] [% END %] - - [% Asset.js("js/catalog.js") | $raw %] @@ -603,13 +603,13 @@ [% END %] [% IF ( Koha.Preference('CatalogConcerns') ) %] - [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] [% END %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt index 809cc3abfa4..a1e597fda94 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt @@ -18,7 +18,7 @@ [% INCLUDE 'calendar.inc' %] [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] [% INCLUDE 'select2.inc' %] - [% Asset.js("js/cataloging.js") | $raw %] [% Asset.js("js/browser.js") | $raw %] - [% END %] - [% IF ( Koha.Preference('SelfCheckInUserJS') ) %] - [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt index b930c847e08..81214220106 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt @@ -32,7 +32,7 @@ [% END %] - [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt index 3228f8d1c70..e38cbd84ba4 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt @@ -13,7 +13,7 @@ [% IF stylesheet %] [% END %] - [% Asset.js("js/holds.js") | $raw %] [% IF ( Koha.Preference('SCOUserJS') ) %] - [% END %] -- 2.34.1