gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38365: Integrate CSP middleware into Plack apps 

Add Koha::Middleware::ContentSecurityPolicy to the middleware chain
in both app.psgi and the Debian plack.psgi template.

Without this integration, the CSP feature would not work - the
middleware was created but never activated. This adds it to:
- app.psgi (development/git install)
- debian/templates/plack.psgi (opac, intranet, and intranet_svc mounts)

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Martin Renvoize 2026-02-02 09:59:09 +00:00 committed by Jonathan Druart
parent 4301202a2d
commit 47a28d62f9
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app.psgi
View File

@ -56,6 +56,7 @@ builder {
enable 'ReverseProxy';
enable '+Koha::Middleware::UserEnv';
enable '+Koha::Middleware::SetEnv';
enable '+Koha::Middleware::ContentSecurityPolicy';
enable '+Koha::Middleware::RealIP';
sub {

3
debian/templates/plack.psgi vendored
View File

@ -99,6 +99,7 @@ builder {
enable 'LogWarn';
}
enable "+Koha::Middleware::CSRF";
enable '+Koha::Middleware::ContentSecurityPolicy';
$opac;
};
mount '/intranet' => builder {
@ -119,6 +120,7 @@ builder {
enable 'LogWarn';
}
enable "+Koha::Middleware::CSRF";
enable '+Koha::Middleware::ContentSecurityPolicy';
$intranet;
};
mount '/intranet_svc' => builder {
@ -127,6 +129,7 @@ builder {
enable 'LogWarn';
}
enable "+Koha::Middleware::CSRF";
enable '+Koha::Middleware::ContentSecurityPolicy';
$intranet_svc;
};
mount '/api/v1/app.pl' => builder {