February 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193301|0 |1 is obsolete| | --- Comment #217 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193954 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193954&action=e… Bug 38365: Fix nonce caching and add to framework plugin scripts Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193300|0 |1 is obsolete| | --- Comment #216 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193953 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193953&action=e… Bug 38365: Add <style to add_csp_nonces.pl to add nonce to style elements Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193299|0 |1 is obsolete| | --- Comment #215 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193952 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193952&action=e… Bug 38365: Add CSP violation reporting API endpoint Add /api/v1/public/csp-reports endpoint to receive and log Content-Security-Policy violation reports from browsers. When CSP is configured with a report-uri directive pointing to this endpoint, browsers will POST violation reports whenever a CSP rule is violated. These reports are logged using Koha's logging system for administrator review. Features: - Public endpoint (no authentication required, as browsers send these reports automatically) - Logs violations at WARN level with key details (violated directive, blocked URI, document URI, source location) - Logs full report at DEBUG level for detailed analysis - Accepts both application/csp-report and application/json content types Configuration example (in koha-conf.xml csp_header_value): ...; report-uri /api/v1/public/csp-reports Log4perl configuration to capture CSP violations: log4perl.logger.api.csp = WARN, CSP log4perl.appender.CSP = Log::Log4perl::Appender::File log4perl.appender.CSP.filename = /var/log/koha/csp-violations.log log4perl.appender.CSP.layout = PatternLayout log4perl.appender.CSP.layout.ConversionPattern = [%d] %m%n Also updates koha-conf.xml documentation with CSP configuration guidance. Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193298|0 |1 is obsolete| | --- Comment #214 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193951 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193951&action=e… Bug 38365: Add script to insert CSP nonces into templates Add misc/devel/add_csp_nonces.pl which automatically adds CSP nonce attributes to inline <script> tags in Koha templates. The script: - Finds all .tt and .inc files in koha-tmpl/ - Adds nonce="[% Koha.CSPNonce | $raw %]" to inline scripts - Skips external scripts (those with src= attribute) - Skips scripts that already have nonce= attribute - Skips third-party library files in lib/ and vendor/ Usage: perl misc/devel/add_csp_nonces.pl # Dry run perl misc/devel/add_csp_nonces.pl --apply # Apply changes This script enables easy backporting of CSP nonce support to older Koha versions by running it against their template directories. Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193297|0 |1 is obsolete| | --- Comment #213 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193950 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193950&action=e… Bug 38365: Fix no-op //= operator on variable declarations The //= (defined-or assignment) operator on a freshly declared variable is a no-op since the variable is always undef at that point. Replace with simple = assignment. Affects header_name(), header_value(), and is_enabled() methods. Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193296|0 |1 is obsolete| | --- Comment #212 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193949 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193949&action=e… Bug 38365: Increase CSP nonce entropy to 128+ bits OWASP recommends CSP nonces have at least 128 bits of entropy. The previous 10-character alphanumeric nonce provided only ~59 bits (log2(62^10) ≈ 59.5). Increase to 22 characters which provides ~130 bits of entropy (log2(62^22) ≈ 130.5), exceeding the OWASP recommendation. Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193295|0 |1 is obsolete| | --- Comment #211 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193948 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193948&action=e… Bug 38365: Integrate CSP middleware into Plack apps Add Koha::Middleware::ContentSecurityPolicy to the middleware chain in both app.psgi and the Debian plack.psgi template. Without this integration, the CSP feature would not work - the middleware was created but never activated. This adds it to: - app.psgi (development/git install) - debian/templates/plack.psgi (opac, intranet, and intranet_svc mounts) Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193294|0 |1 is obsolete| | --- Comment #210 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193947 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193947&action=e… Bug 38365: Add "style-src-attr 'unsafe-inline';" to default policy This change adds "style-src-attr 'unsafe-inline';" to the default CSP policy. The reason is that we have a lot of inline styles throughout Koha, and it will take a long time to clean those up. Also, the WYSIWYG/TinyMCE editor injects inline styles, so it might not be possible to forbid unsafe inline styles in Koha. Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193293|0 |1 is obsolete| | --- Comment #209 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193946 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193946&action=e… Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce This patch adds a new Template plugin method, Koha.CSPNonce, that can be used to attach the Content Security Policy nonce into our templates. To test: 1. prove t/Koha/Middleware/ContentSecurityPolicy.t 2. prove t/db_dependent/Koha/Template/Plugin/Koha.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193292|0 |1 is obsolete| | --- Comment #208 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193945 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193945&action=e… Bug 38365: Add Koha::Middleware::ContentSecurityPolicy This patch adds a new Perl package, Koha::Middleware::ContentSecurityPolicy. It is called for each Plack requests, and its job is to add the Content-Security-Policy[-Report-Only] header with the configured value. To test: 1. prove t/Koha/Middleware/ContentSecurityPolicy.t 2. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0