From bugzilla-daemon@bugs.koha-community.org Fri Mar 13 10:54:18 2026
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 38365] Add Content-Security-Policy HTTP header to
 HTML responses
Date: Fri, 13 Mar 2026 09:46:28 +0000
Message-ID: <bug-38365-70-3EzMIsHQCy@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-38365-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0875785043159739915=="

--===============0875785043159739915==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365

--- Comment #377 from Jonathan Druart <jonathan.druart@gmail.com> ---
Created attachment 195273
  -->
https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195273&action=edit
Bug 38365: Add script to insert CSP nonces into templates

Add misc/devel/add_csp_nonces.pl which automatically adds CSP nonce
attributes to inline <script> tags in Koha templates.

The script:
- Finds all .tt and .inc files in koha-tmpl/
- Adds nonce="[% Koha.CSPNonce | $raw %]" to inline scripts
- Skips external scripts (those with src= attribute)
- Skips scripts that already have nonce= attribute
- Skips third-party library files in lib/ and vendor/

Usage:
  perl misc/devel/add_csp_nonces.pl          # Dry run
  perl misc/devel/add_csp_nonces.pl --apply  # Apply changes

This script enables easy backporting of CSP nonce support to older
Koha versions by running it against their template directories.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

-- 
You are receiving this mail because:
You are watching all bug changes.

--===============0875785043159739915==--