gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38365: Switch from using ENV to package level variable for nonce caching 

Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
David Cook 2026-03-04 02:52:11 +00:00 committed by Jonathan Druart
parent 9f78d81bf0
commit 38475a3e35
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Koha/ContentSecurityPolicy.pm
View File

@ -24,6 +24,10 @@ use Koha::Token;
use Koha::Exceptions::Config;
#NOTE: To cache the nonce, we just use a package level variable,
#which will be reset after every HTTP request.
my $cached_nonce;
=head1 NAME
Koha::ContentSecurityPolicy - Object for handling Content-Security-Policy header
@ -192,7 +196,7 @@ sub get_nonce {
#Koha::Middleware::ContentSecurityPolicy sets an environmental variable
#We cannot use the L1 cache since it is cleared after the middleware is applied
my $env_value = $ENV{CSP_NONCE};
my $env_value = $cached_nonce;
return $env_value;
}
@ -216,10 +220,10 @@ sub set_nonce {
#Koha::Middleware::ContentSecurityPolicy sets an environmental variable
#We cannot use the L1 cache since it is cleared after the middleware is applied
if ($nonce) {
$ENV{CSP_NONCE} = $nonce;
$cached_nonce = $nonce;
} else {
my $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } );
$ENV{CSP_NONCE} = $nonce;
$cached_nonce = $nonce;
}
return 1;
}