From 12f225d0baf3bb3630e4de18c139b2fa70d4c96b Mon Sep 17 00:00:00 2001 From: David Cook Date: Fri, 31 Oct 2025 04:09:22 +0000 Subject: [PATCH] Bug 38365: add nonce to style-src and add default csp to Debian koha-conf.xml template Signed-off-by: David Cook Signed-off-by: Martin Renvoize Signed-off-by: Lari Taskula --- debian/templates/koha-conf-site.xml.in | 16 ++++++++++++++++ etc/koha-conf.xml | 5 +++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in index 5edefab8b25..f07de5f35e7 100644 --- a/debian/templates/koha-conf-site.xml.in +++ b/debian/templates/koha-conf-site.xml.in @@ -500,5 +500,21 @@ __END_SRU_PUBLICSERVER__ 1 + + + + + + default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + + + + + + + default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + + + diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml index d554a595fb3..616e21a4253 100644 --- a/etc/koha-conf.xml +++ b/etc/koha-conf.xml @@ -316,15 +316,16 @@ - default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' - default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' + default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' + -- 2.39.5