gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38365: add nonce to style-src and add default csp to Debian koha-conf.xml template 

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
David Cook 2025-10-31 04:09:22 +00:00 committed by Jonathan Druart
parent 3dd4cdc3f5
commit 65873238ce
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
debian/templates/koha-conf-site.xml.in vendored
View File

@ -500,5 +500,21 @@ __END_SRU_PUBLICSERVER__
<parallel_loops_count>1</parallel_loops_count>
</auto_renew_cronjob>
<content_security_policy>
<opac>
<!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
<csp_mode></csp_mode>
<!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
</opac>
<intranet>
<!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
<csp_mode></csp_mode>
<!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
</intranet>
</content_security_policy>
</config>
</yazgfs>

5
etc/koha-conf.xml
View File

@ -316,15 +316,16 @@
<!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
<csp_mode></csp_mode>
<!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
</opac>
<intranet>
<!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
<csp_mode></csp_mode>
<!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
</intranet>
</content_security_policy>
</config>
</yazgfs>