From ffb322ba90eec84c5313e81cfc28d7631ec82f98 Mon Sep 17 00:00:00 2001 From: David Cook Date: Thu, 5 Mar 2026 05:39:03 +0000 Subject: [PATCH] Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports By setting __webpack_nonce__ webpack/rspack will add the nonce to styles added using style-loader plugin. Also, stop fontawesome from auto injecting CSS elements, and instead manually import them so that they can be picked up by style-loader --- .../prog/en/includes/doc-head-close.inc | 3 ++ .../intranet-tmpl/prog/js/vue/csp-nonce.js | 1 + .../prog/js/vue/modules/acquisitions.ts | 4 ++- .../js/vue/modules/admin/record_sources.ts | 4 ++- .../intranet-tmpl/prog/js/vue/modules/erm.ts | 4 ++- .../prog/js/vue/modules/preservation.ts | 4 ++- .../intranet-tmpl/prog/js/vue/modules/sip2.ts | 4 ++- rspack.config.js | 36 ++++++++++++++----- 8 files changed, 47 insertions(+), 13 deletions(-) create mode 100644 koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc index 3f2b44676f9..a5ab7d6652f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc @@ -8,6 +8,9 @@ [% IF logged_in_user %][% END %] + [%# Prevent XFS attacks -%] [% UNLESS popup %]