gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38365: Add content_security_policy section to koha-conf.xml 

To test:
1. xmllint --noout --nonet etc/koha-conf.xml; echo $?
2. Observe 0

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Lari Taskula 2025-10-27 19:28:24 +02:00 committed by Jonathan Druart
parent 2a6316e462
commit 3dd4cdc3f5
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
etc/koha-conf.xml
View File

@ -311,5 +311,20 @@
<parallel_loops_count>1</parallel_loops_count>
</auto_renew_cronjob>
<content_security_policy>
<opac>
<!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
<csp_mode></csp_mode>
<!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
</opac>
<intranet>
<!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
<csp_mode></csp_mode>
<!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
<csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
</intranet>
</content_security_policy>
</config>
</yazgfs>