From bugzilla-daemon@bugs.koha-community.org Fri Mar  6 01:22:07 2026
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 38365] Add Content-Security-Policy HTTP header to
 HTML responses
Date: Fri, 06 Mar 2026 00:21:27 +0000
Message-ID: <bug-38365-70-VtsmSrTYK1@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-38365-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7059470390638976740=="

--===============7059470390638976740==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365

David Cook <dcook@prosentient.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #193951|0                           |1
        is obsolete|                            |

--- Comment #287 from David Cook <dcook@prosentient.com.au> ---
Created attachment 194579
  -->
https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194579&action=edit
Bug 38365: Add script to insert CSP nonces into templates

Add misc/devel/add_csp_nonces.pl which automatically adds CSP nonce
attributes to inline <script> tags in Koha templates.

The script:
- Finds all .tt and .inc files in koha-tmpl/
- Adds nonce="[% Koha.CSPNonce | $raw %]" to inline scripts
- Skips external scripts (those with src= attribute)
- Skips scripts that already have nonce= attribute
- Skips third-party library files in lib/ and vendor/

Usage:
  perl misc/devel/add_csp_nonces.pl          # Dry run
  perl misc/devel/add_csp_nonces.pl --apply  # Apply changes

This script enables easy backporting of CSP nonce support to older
Koha versions by running it against their template directories.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>

-- 
You are receiving this mail because:
You are watching all bug changes.

--===============7059470390638976740==--