March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #372 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 195268 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195268&action=e… Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce This patch adds a new Template plugin method, Koha.CSPNonce, that can be used to attach the Content Security Policy nonce into our templates. To test: 1. prove t/Koha/Middleware/ContentSecurityPolicy.t 2. prove t/db_dependent/Koha/Template/Plugin/Koha.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #371 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 195267 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195267&action=e… Bug 38365: Add Koha::Middleware::ContentSecurityPolicy This patch adds a new Perl package, Koha::Middleware::ContentSecurityPolicy. It is called for each Plack requests, and its job is to add the Content-Security-Policy[-Report-Only] header with the configured value. To test: 1. prove t/Koha/Middleware/ContentSecurityPolicy.t 2. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #370 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 195266 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195266&action=e… Bug 38365: Add Koha::ContentSecurityPolicy This patch adds a new Perl package, Koha::ContentSecurityPolicy. It provides the following methods: $csp->header_name Returns the name of the CSP header, based on koha-conf configuration. $csp->header_value Returns the value of the CSP header, based on koha-conf configuration. $csp->is_enabled Returns true or false, based on koha-conf configuration. $csp->nonce Generates or sets, and returns the nonce. A CSP nonce is a random token that is used both in the inline scripts and the Content-Security-Policy[-Report-Only] response header. To test: 1. prove t/Koha/ContentSecurityPolicy.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #369 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 195265 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195265&action=e… Bug 38365: Remove unsafe CSP rules Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #368 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 195264 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195264&action=e… Bug 38365: add nonce to style-src and add default csp to Debian koha-conf.xml template Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #367 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 195263 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195263&action=e… Bug 38365: Add content_security_policy section to koha-conf.xml To test: 1. xmllint --noout --nonet etc/koha-conf.xml; echo $? 2. Observe 0 Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Jonathan Druart <jonathan.druart(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195249|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Jonathan Druart <jonathan.druart(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195165|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Jonathan Druart <jonathan.druart(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195107|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Jonathan Druart <jonathan.druart(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195076|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0