From fabe480e52adc8b1bb0258403b19dcd3c02a5ac7 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date: Tue, 24 Mar 2026 10:12:38 +0100
Subject: [PATCH] Bug 10190: (follow-up) Add missing CSP nonce to inline script
 tag

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 .../intranet-tmpl/prog/en/modules/admin/circulation_triggers.tt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/circulation_triggers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/circulation_triggers.tt
index c42a87abb6..515b8ce425 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/circulation_triggers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/circulation_triggers.tt
@@ -30,7 +30,7 @@
         <!-- FIXME: this shouldn't be needed -->
         [% INCLUDE 'datatables.inc' %]
         [% INCLUDE 'js-date-format.inc' %]
-        <script>
+        <script nonce="[% Koha.CSPNonce | $raw %]">
             const letters = [% To.json(letters) | $raw %];
             const default_view = "[%- IF Koha.Preference('DefaultToLoggedInLibraryOverdueTriggers') -%][% Branches.GetLoggedInBranchcode | html %][%- ELSE -%]*[%- END -%]";
             const from_branch = "[% Koha.Preference('OverdueNoticeFrom') | html %]";