From 2783a0b334c49bcf2a6679df61500104ecf47f09 Mon Sep 17 00:00:00 2001 From: David Cook Date: Thu, 5 Mar 2026 05:39:03 +0000 Subject: [PATCH] Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports By setting __webpack_nonce__ webpack/rspack will add the nonce to styles added using style-loader plugin. Also, stop fontawesome from auto injecting CSS elements, and instead manually import them so that they can be picked up by style-loader --- .../prog/en/includes/doc-head-close.inc | 3 ++ .../intranet-tmpl/prog/js/vue/csp-nonce.js | 1 + .../prog/js/vue/modules/acquisitions.ts | 4 ++- .../js/vue/modules/admin/record_sources.ts | 4 ++- .../intranet-tmpl/prog/js/vue/modules/erm.ts | 4 ++- .../prog/js/vue/modules/preservation.ts | 4 ++- .../intranet-tmpl/prog/js/vue/modules/sip2.ts | 4 ++- rspack.config.js | 36 ++++++++++++++----- 8 files changed, 47 insertions(+), 13 deletions(-) create mode 100644 koha-tmpl/intranet-tmpl/prog/js/vue/csp-nonce.js diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc index 44d74f97e52..2c0b32597be 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc @@ -8,6 +8,9 @@ [% IF logged_in_user %][% END %] + [%# Prevent XFS attacks -%] [% UNLESS popup %]