June 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 01 Jun '26

01 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42725 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42725 [Bug 42725] Show effective Content-Security-Policy in about.pl UI? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42725] New: Show effective Content-Security-Policy in about.pl UI?
by bugzilla-daemon＠bugs.koha-community.org 01 Jun '26

01 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42725 Bug ID: 42725 Summary: Show effective Content-Security-Policy in about.pl UI? Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Web users of the staff interface cannot change the Content-Security-Policy setting, but it could be useful for them to see its content in an easily accessible way in about.pl This way, we could encourage library staff to review their about.pl System Information and then contact their technical team for updates if necessary. I'm just trying to think of ways of building awareness about security topics, which will help out Koha libraries in practical ways. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 01 Jun '26

01 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #436 from David Cook <dcook(a)prosentient.com.au> --- Posting here just to gather feedback from interested parties... What do people think about showing the effective Content-Security-Policy on the about.pl page? It's trivial for a tech savvy person to see the policy. They just need to review the headers sent back from the server. If we show the policy to a non-technical audience, they'd at least be able to speak to the current state of affairs *to* their technical teams. I mention this because it would be nice to be able to refer people to the Content-Security-Policy in https://wiki.koha-community.org/wiki/Security_Hardening_Guide While I can say "oh hey look at the headers or look at koha-conf.xml", it's probably going to be more meaningful to see the config in about.pl Anyway, food for thought. -- You are receiving this mail because: You are watching all bug changes.

1 0