From 62ff741f898d622969aa2fccc0c4d18620d127a3 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 12 Mar 2026 10:50:39 +0100 Subject: [PATCH] Bug 38365: Add CSP nonces to all inline script and style tags Signed-off-by: Lari Taskula Amended-by: Jonathan Druart Regenerated the patch on top of bug 41324, using: perl misc/devel/add_csp_nonces.pl --apply ============================================================ Summary: Files scanned: 881 Files modified: 456 Tags modified: 800 ============================================================ Also note that this manual change: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt - [% END %] - [%# Prevent XFS attacks -%] [% UNLESS popup %] - + [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc index d58325a3118..b739f8ac4cf 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc @@ -1,6 +1,6 @@ [% USE Koha %] - - [% IF lang && lang != 'en' %] @@ -19,7 +19,7 @@ [% Asset.js('js/Gettext.js') | $raw %] [% Asset.js('js/i18n.js') | $raw %] [% Asset.js('js/stores.js') | $raw %] - - - [% END %] [% IF ( bookselleridfrom ) %] - - [% Asset.js("js/vue/dist/acquisitions.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt index 723f8adfc5a..329ab09ee3a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt @@ -20,7 +20,7 @@ [% INCLUDE 'doc-head-close.inc' %] [% USE Koha %] - - - [% UNLESS library %] - @@ -861,7 +861,7 @@ [% INCLUDE 'calendar.inc' %] [% INCLUDE 'datatables.inc' %] [% INCLUDE 'select2.inc' %] - [% Asset.js("js/categories.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt index a8a47d0c21b..72cc4fa4716 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt @@ -204,7 +204,7 @@ [% MACRO jsinclude BLOCK %] [% Asset.js("js/admin-menu.js") | $raw %] [% INCLUDE 'datatables.inc' %] - - - - - - - - - [% Asset.js("js/marc_subfields_structure.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt index 12c7bb6fe8f..074e951b2db 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt @@ -330,7 +330,7 @@ [% MACRO jsinclude BLOCK %] [% INCLUDE 'datatables.inc' %] [% Asset.js("js/admin-menu.js") | $raw %] - [% END %] [% IF op == 'edit_form' || op == 'add_form' %] - [% ELSE %] - - [% END %] - [% ELSE %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt index 1809a110cef..fb12d72d7f8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt @@ -40,7 +40,7 @@ [%- END -%] [% END %] [% MACRO jsinclude BLOCK %] - [% Asset.js("js/authorities.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt index bc0b357e48b..b490729c3e1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt @@ -16,7 +16,7 @@ > [% INCLUDE 'doc-head-close.inc' %] [% INCLUDE 'select2.inc' %] - [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] [% Asset.js("js/cataloging.js") | $raw %] - [% Asset.css("css/addbiblio.css") | $raw %] - - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt index 809cc3abfa4..a1e597fda94 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt @@ -18,7 +18,7 @@ [% INCLUDE 'calendar.inc' %] [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] [% INCLUDE 'select2.inc' %] - [% Asset.js("js/cataloging.js") | $raw %] [% Asset.js("js/browser.js") | $raw %] - - - - + [% END %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt index ffd2bd911cd..90659df0e21 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt @@ -240,7 +240,7 @@ [% Asset.js("js/pages/circulation.js") | $raw %] [% INCLUDE 'calendar.inc' %] [% IF error %] - - - - - - - [% IF CAN_user_clubs_enroll %] - - - [% END %] @@ -1121,11 +1121,11 @@ [% INCLUDE 'calendar.inc' %] [% INCLUDE 'select2.inc' %] [% IF metadata_enrichment_services %] - - [% END %] - - - - - - - - - [% IF ( SUCCESS ) %] - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt index b285cf113ab..3340f272c5f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt @@ -107,7 +107,7 @@ [% END %] [% MACRO jsinclude BLOCK %] - - - - - - - - - - - - - - [% UNLESS patron %] [% SET search_results_block_id = 'holds_patronsearch_pane_panel' %] [%# adjusting variable for patron-search.inc %] [% PROCESS patron_search_js table_id => 'table_borrowers', categories => categories, libraries => libraries, columns => columns, open_on_row_click => 1, on_click_url => '/cgi-bin/koha/reserve/request.pl?' _ url_biblio_params, redirect_if_one_result => 1, redirect_url => '/cgi-bin/koha/reserve/request.pl?' _ url_biblio_params, redirect_if_attribute_equal => 'cardnumber' %] - [% END %] - - [% Asset.js("js/serials-toolbar.js") | $raw %] - - - + [% END %] [% IF Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) %] - @@ -62,7 +62,7 @@ [% SET SCOUserCSS = Koha.Preference('SCOUserCSS') %] [% IF SCOUserCSS %] - + [% END %] [% END %] @@ -73,7 +73,7 @@ [% FILTER collapse %] [% PROCESS cssinclude %] [% END %] - [% Asset.js("lib/greybox/AJS.js") | $raw %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc index 1f94b8046eb..64c75c187bf 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc @@ -139,7 +139,7 @@

Unknown stage. This should not have happened.

[% END %] [% BLOCK backend_jsinclude %] - - [% Asset.js("js/global.js") | $raw %] @@ -106,7 +106,7 @@ [% IF ( OPACAmazonCoverImages || SyndeticsCoverImages ) %] [% Asset.js("js/amazonimages.js") | $raw %] [% END %] - [% END %] @@ -159,7 +159,7 @@ [% IF ( BakerTaylorEnabled ) %] [% Asset.js("js/bakertaylorimages.js") | $raw %] - [% END %] [% IF Branches.GetBranchSpecificJS( Branches.GetLoggedInBranchcode() || default_branch) %] - [% END %] [% IF SCO_login %] [% SET SCOUserJS = Koha.Preference('SCOUserJS') %] [% IF ( SCOUserJS ) %] - [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc index 24cb8e8b8a3..81e3b020f57 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc @@ -1,5 +1,5 @@ [% USE Koha %] - - - - [% END # / TagsInputEnabled && loggedinusername %] - - - - [% INCLUDE 'calendar.inc' %] [% INCLUDE 'datatables.inc' %] - - [% IF ( Koha.Preference('OPACShowMusicalInscripts') ) %] - [% Asset.js("js/verovio.js") | $raw %] [% END %] - [% IF ( NovelistSelectProfile && ( normalized_isbn || normalized_upc ) ) %] - - - [% IF op == 'availability' %] [% Asset.js("js/ill-availability.js") | $raw %] - - - - [% Asset.js("js/results-list.js") | $raw %] [% Asset.js("js/cover_images.js") | $raw %] - - [% Asset.js("js/results-list.js") | $raw %] [% Asset.js("js/cover_images.js") | $raw %] - [% IF ( loggedinusername ) %] - [% END %] - [% Asset.js("js/results-list.js") | $raw %] - - - [% IF ( Koha.Preference('SelfCheckInUserJS') ) %] - [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt index f1aaf98a79a..60965f13484 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt @@ -23,22 +23,22 @@ [% Asset.css("css/sco.css") | $raw %] [% IF ( Koha.Preference('OPACUserCSS') ) %] - + [% END %] [% IF Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) %] - [% END %] [% IF ( SCOUserCSS ) %] - + [% END %] - [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt index ff542c5dc13..51a382b91ef 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt @@ -20,7 +20,7 @@ [% IF stylesheet %] [% END %] - [% IF Koha.Preference('AudioAlerts') %] - [% END %] - [% Asset.js("js/holds.js") | $raw %] [% IF ( Koha.Preference('SCOUserJS') ) %] - [% END %] -- 2.43.0