March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195060|0 |1 is obsolete| | --- Comment #348 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195070 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195070&action=e… Bug 38365: (follow-up) Merge CSP middleware tests It seems the test outside of db_dependent required presence of database after all To test: 1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195059|0 |1 is obsolete| | --- Comment #347 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195069 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195069&action=e… Bug 38365: Use Koha::Devel::Files->ls_tt_files in add_csp_nonces.pl Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195058|0 |1 is obsolete| | --- Comment #346 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195068 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195068&action=e… Bug 38365: Add xt test Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195047|0 |1 is obsolete| | --- Comment #345 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195067 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195067&action=e… Bug 38365: Adjust t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt This file now tidies after the patch "Make tidy.pl compatible with script elements with attributes" -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194622|0 |1 is obsolete| | --- Comment #344 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195066 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195066&action=e… Bug 38365: Add test_valuebuilder_popup.tt to the exception list -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195050|0 |1 is obsolete| | --- Comment #343 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195065 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195065&action=e… Bug 38365: Add CSP nonces to all inline script and style tags Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194609|0 |1 is obsolete| | --- Comment #342 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195064 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195064&action=e… Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports By setting __webpack_nonce__ webpack/rspack will add the nonce to styles added using style-loader plugin. Also, stop fontawesome from auto injecting CSS elements, and instead manually import them so that they can be picked up by style-loader -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195049|0 |1 is obsolete| | --- Comment #341 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195063 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195063&action=e… Bug 38365: Make tidy.pl compatible with script elements with attributes tidy.pl will still tidy whitespace around script elements that have attributes like "nonce" Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194607|0 |1 is obsolete| | --- Comment #340 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195062 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195062&action=e… Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t This initialises the CSP nonce in the unit test so that t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt will get its script element rewritten correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194606|0 |1 is obsolete| | --- Comment #339 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195061 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195061&action=e… Bug 38365: Make swagger-cli happy Schema type [array,object] is not valid in OpenAPI version 2. There are two different CSP reporting directives. One is the now deprecated "report-uri" directive. Browsers typically send a single JSON object following the CSP2 specification. "report-uri" is deprecated in CSP3 in favor of the newer "report-to" directive. It is expected to contain an array of report objects. There are browser that do not yet support the "report-to" directive, so both directives should be supported. There are also variations among the "report-uri" format. See https://www.tollmanz.com/content-security-policy-report-samples/ Because of these variations, it becomes quite complex to handle the most common cases in a single API endpoint. We could build two separate endpoints for both directives. Or we can accept any type of input and handle the variations in a single endpoint. This patch attempts to do that. Before this patch input parameters were validated by JSON::Validator. That is the normal and recommended way to build OpenAPI endpoints in Koha. After this patch we remove all input parameter restrictions from the OpenAPI spec, and simply accept any type of body. This means the controller will now always return a HTTP 204 regardless of the type of data passed to the controller. It instead truncates too long input before writing them into log files. As this is not an endpoint that developers will build new Koha clients for, we do not have to offer a very in-depth input parameter spec for this endpoint. To test: 1. t/db_dependent/api/v1/public/csp_reports.t -- You are receiving this mail because: You are watching all bug changes.

1 0