From bugzilla-daemon@bugs.koha-community.org Wed Mar 11 03:28:22 2026
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 38365] Add Content-Security-Policy HTTP header to
 HTML responses
Date: Wed, 11 Mar 2026 02:28:21 +0000
Message-ID: <bug-38365-70-BYL1Ibesp8@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-38365-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1934557057717751660=="

--===============1934557057717751660==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D38365

--- Comment #357 from David Cook <dcook@prosentient.com.au> ---
(In reply to David Cook from comment #356)
> Once bug 38365 is pushed, we can require that people add nonces to <script>
> and <style> inline elements (the QA tools will alert to this).=20
>=20
> And then I'll continue the work on bug 38407. Since the value builders are
> handled by Koha::FrameworkPlugin, that leaves only about 117 lines across 33
> files, which isn't too bad at all. (But I agree is out of scope for bug
> 38365, which is big enough already.)

Actually maybe some plugins do still have some inline event handlers. I'll de=
al
with this too though.

--=20
You are receiving this mail because:
You are watching all bug changes.

--===============1934557057717751660==--