From 0cdf8a74c8388bbc1eac9eea13b65682cc5839b5 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date: Tue, 21 Apr 2026 15:11:42 +0100
Subject: [PATCH] Bug 26355: (QA follow-up) Add CSP nonce to inline module
 script

The forbidden_patterns QA check requires <script> elements to have
either a "src" or "nonce" attribute. The inline module script that
hydrates the Vue island in opac-user.tt was missing a nonce.

Test plan:
1. Run the QA tool against opac-user.tt; forbidden_patterns should
   no longer report the inline <script> on line 1024.
2. Load the OPAC user summary page and confirm the Vue island still
   hydrates (no CSP violation in the browser console).

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
index 62a9b95b23..beb1f9cde6 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
@@ -1021,7 +1021,7 @@
 [% SET islands = Asset.js("js/vue/dist/islands.esm.js").match('(src="([^"]+)")').1 %]
 <script src="[% islands | $raw %]" type="module">
 </script>
-<script type="module">
+<script type="module" nonce="[% Koha.CSPNonce | $raw %]">
     import { hydrate } from "[% islands | $raw %]";
     hydrate();
 </script>