From bc2b47adf08626c18981d069c27e691b2d6f37d1 Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 4 Mar 2026 02:52:11 +0000 Subject: [PATCH] Bug 38365: Switch from using ENV to package level variable for nonce caching --- Koha/ContentSecurityPolicy.pm | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/Koha/ContentSecurityPolicy.pm b/Koha/ContentSecurityPolicy.pm index bcbad58d1db..2adacd0611e 100644 --- a/Koha/ContentSecurityPolicy.pm +++ b/Koha/ContentSecurityPolicy.pm @@ -24,6 +24,10 @@ use Koha::Token; use Koha::Exceptions::Config; +#NOTE: To cache the nonce, we just use a package level variable, +#which will be reset after every HTTP request. +my $cached_nonce; + =head1 NAME Koha::ContentSecurityPolicy - Object for handling Content-Security-Policy header @@ -192,7 +196,7 @@ sub get_nonce { #Koha::Middleware::ContentSecurityPolicy sets an environmental variable #We cannot use the L1 cache since it is cleared after the middleware is applied - my $env_value = $ENV{CSP_NONCE}; + my $env_value = $cached_nonce; return $env_value; } @@ -216,10 +220,10 @@ sub set_nonce { #Koha::Middleware::ContentSecurityPolicy sets an environmental variable #We cannot use the L1 cache since it is cleared after the middleware is applied if ($nonce) { - $ENV{CSP_NONCE} = $nonce; + $cached_nonce = $nonce; } else { my $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } ); - $ENV{CSP_NONCE} = $nonce; + $cached_nonce = $nonce; } return 1; } -- 2.39.5