February 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193710|0 |1 is obsolete| | --- Comment #227 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193964 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193964&action=e… Bug 38365: Move default Content-Security-Policy value into Perl module By defining a default policy in the Perl module, we can easily update it over time. Using koha-conf.xml will just be for overrides, so people can manage their own there. Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193709|0 |1 is obsolete| | --- Comment #226 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193963 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193963&action=e… Bug 38365: Disable the endpoint when CSP is disabled in KOHA_CONF To test: 1. prove t/db_dependent/api/v1/public/csp_reports.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193708|0 |1 is obsolete| | --- Comment #225 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193962 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193962&action=e… Bug 38365: (QA follow-up) Fix param sample indentation Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193707|0 |1 is obsolete| | --- Comment #224 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193961 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193961&action=e… Bug 38365: Restore violated-directive The violated-directive is a historic name for the effective-directive field and contains the same value. Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193706|0 |1 is obsolete| | --- Comment #223 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193960 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193960&action=e… Bug 38365: (follow-up) Add support for both CSP report syntaxes This patch fixes failing tests from the previous patch and adds more tests that cover multiple violation reports in one POST request. To test: 1. prove t/db_dependent/api/v1/public/csp_reports.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193705|0 |1 is obsolete| | --- Comment #222 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193959 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193959&action=e… Bug 38365: Add support for both CSP report syntaxes Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193305|0 |1 is obsolete| | --- Comment #221 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193958 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193958&action=e… Bug 38365: Add application/reports+json as accepted Content-Type report-to directive uses application/reports+json To test: 1. prove t/db_dependent/api/v1/public/csp_reports.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193304|0 |1 is obsolete| | --- Comment #220 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193957 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193957&action=e… Bug 38365: Set limitations on endpoint input This patch attempts to set some sane input limits to the CSP violation report. To test: 1. Rebuild API redocly bundle --ext json api/v1/swagger/swagger.yaml --output api/v1/swagger/swagger_bundle.json 2. t/db_dependent/api/v1/public/csp_reports.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193303|0 |1 is obsolete| | --- Comment #219 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193956 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193956&action=e… Bug 38365: Use report-to with Reporting-Endpoints report-uri is deprecated, replaced by report-to and Reporting-Endpoints. To test: 1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193302|0 |1 is obsolete| | --- Comment #218 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193955 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193955&action=e… Bug 38365: Add default log4perl configuration This patch adds the default configuration to log4perl.conf. Note we are passing a non-standard interface 'csp' to Koha::Logger. This is to avoid log entries from propagating up to api-error.log. To test: 1. prove t/db_dependent/api/v1/public/csp_reports.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0