gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 26355: (QA follow-up) Add CSP nonce to inline module script 

The forbidden_patterns QA check requires <script> elements to have
either a "src" or "nonce" attribute. The inline module script that
hydrates the Vue island in opac-user.tt was missing a nonce.

Test plan:
1. Run the QA tool against opac-user.tt; forbidden_patterns should
   no longer report the inline <script> on line 1024.
2. Load the OPAC user summary page and confirm the Vue island still
   hydrates (no CSP violation in the browser console).

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Martin Renvoize 2026-04-21 15:11:42 +01:00 committed by Lucas Gass
parent bce9aad974
commit 0cdf8a74c8
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
View File

@ -1021,7 +1021,7 @@
[% SET islands = Asset.js("js/vue/dist/islands.esm.js").match('(src="([^"]+)")').1 %]
<script src="[% islands | $raw %]" type="module">
</script>
<script type="module">
<script type="module" nonce="[% Koha.CSPNonce | $raw %]">
import { hydrate } from "[% islands | $raw %]";
hydrate();
</script>