4971626204
Add /api/v1/public/csp-reports endpoint to receive and log Content-Security-Policy violation reports from browsers. When CSP is configured with a report-uri directive pointing to this endpoint, browsers will POST violation reports whenever a CSP rule is violated. These reports are logged using Koha's logging system for administrator review. Features: - Public endpoint (no authentication required, as browsers send these reports automatically) - Logs violations at WARN level with key details (violated directive, blocked URI, document URI, source location) - Logs full report at DEBUG level for detailed analysis - Accepts both application/csp-report and application/json content types Configuration example (in koha-conf.xml csp_header_value): ...; report-uri /api/v1/public/csp-reports Log4perl configuration to capture CSP violations: log4perl.logger.api.csp = WARN, CSP log4perl.appender.CSP = Log::Log4perl::Appender::File log4perl.appender.CSP.filename = /var/log/koha/csp-violations.log log4perl.appender.CSP.layout = PatternLayout log4perl.appender.CSP.layout.ConversionPattern = [%d] %m%n Also updates koha-conf.xml documentation with CSP configuration guidance. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> |
||
|---|---|---|
| .. | ||
| docs | ||
| scripts | ||
| source | ||
| templates | ||
| README.build | ||
| bd-to-depends | ||
| build-git-snapshot | ||
| changelog | ||
| clean | ||
| compat | ||
| control | ||
| control.in | ||
| copyright | ||
| koha-common.README.Debian | ||
| koha-common.bash-completion | ||
| koha-common.config | ||
| koha-common.cron.d | ||
| koha-common.cron.daily | ||
| koha-common.cron.hourly | ||
| koha-common.cron.monthly | ||
| koha-common.default | ||
| koha-common.dirs | ||
| koha-common.docs | ||
| koha-common.init | ||
| koha-common.install | ||
| koha-common.links | ||
| koha-common.logrotate | ||
| koha-common.postinst | ||
| koha-common.preinst | ||
| koha-common.service | ||
| koha-common.templates | ||
| koha-core.bash-completion | ||
| koha-core.config | ||
| koha-core.default | ||
| koha-core.dirs | ||
| koha-core.docs | ||
| koha-core.init | ||
| koha-core.install | ||
| koha-core.links | ||
| koha-core.logrotate | ||
| koha-core.postinst | ||
| koha-core.preinst | ||
| koha-core.templates | ||
| koha-full.postinst | ||
| koha-post-install-setup | ||
| koha.README.Debian | ||
| koha.apache-ports | ||
| koha.config | ||
| koha.dirs | ||
| koha.install | ||
| koha.postinst | ||
| koha.postrm | ||
| koha.prerm | ||
| list-deps | ||
| rules | ||
| unavailable.html | ||
| update-control | ||
README.build
In order to build .deb packages, following debian packages need to be present (installed): devscripts pbuilder dh-make fakeroot As root (or sudo) execute: pbuilder create Executing build-git-snapshot without any arguments will leave package and the rest in some pbuilder dir, eg. /var/cache/pbuilder/result It is highly recommended that --buildresult option is used.