- Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193295|0 |1 is obsolete| | --- Comment #211 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193948 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193948&action=e… Bug 38365: Integrate CSP middleware into Plack apps Add Koha::Middleware::ContentSecurityPolicy to the middleware chain in both app.psgi and the Debian plack.psgi template. Without this integration, the CSP feature would not work - the middleware was created but never activated. This adds it to: - app.psgi (development/git install) - debian/templates/plack.psgi (opac, intranet, and intranet_svc mounts) Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193294|0 |1 is obsolete| | --- Comment #210 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193947 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193947&action=e… Bug 38365: Add "style-src-attr 'unsafe-inline';" to default policy This change adds "style-src-attr 'unsafe-inline';" to the default CSP policy. The reason is that we have a lot of inline styles throughout Koha, and it will take a long time to clean those up. Also, the WYSIWYG/TinyMCE editor injects inline styles, so it might not be possible to forbid unsafe inline styles in Koha. Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193293|0 |1 is obsolete| | --- Comment #209 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193946 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193946&action=e… Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce This patch adds a new Template plugin method, Koha.CSPNonce, that can be used to attach the Content Security Policy nonce into our templates. To test: 1. prove t/Koha/Middleware/ContentSecurityPolicy.t 2. prove t/db_dependent/Koha/Template/Plugin/Koha.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193292|0 |1 is obsolete| | --- Comment #208 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193945 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193945&action=e… Bug 38365: Add Koha::Middleware::ContentSecurityPolicy This patch adds a new Perl package, Koha::Middleware::ContentSecurityPolicy. It is called for each Plack requests, and its job is to add the Content-Security-Policy[-Report-Only] header with the configured value. To test: 1. prove t/Koha/Middleware/ContentSecurityPolicy.t 2. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193291|0 |1 is obsolete| | --- Comment #207 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193944 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193944&action=e… Bug 38365: Add Koha::ContentSecurityPolicy This patch adds a new Perl package, Koha::ContentSecurityPolicy. It provides the following methods: $csp->header_name Returns the name of the CSP header, based on koha-conf configuration. $csp->header_value Returns the value of the CSP header, based on koha-conf configuration. $csp->is_enabled Returns true or false, based on koha-conf configuration. $csp->nonce Generates or sets, and returns the nonce. A CSP nonce is a random token that is used both in the inline scripts and the Content-Security-Policy[-Report-Only] response header. To test: 1. prove t/Koha/ContentSecurityPolicy.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193290|0 |1 is obsolete| | --- Comment #206 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193943 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193943&action=e… Bug 38365: Remove unsafe CSP rules Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193289|0 |1 is obsolete| | --- Comment #205 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193942 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193942&action=e… Bug 38365: add nonce to style-src and add default csp to Debian koha-conf.xml template Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193288|0 |1 is obsolete| | --- Comment #204 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193941 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193941&action=e… Bug 38365: Add content_security_policy section to koha-conf.xml To test: 1. xmllint --noout --nonet etc/koha-conf.xml; echo $? 2. Observe 0 Signed-off-by: David Cook <dcook(a)prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize(a)openfifth.co.uk> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11340] Make the 'print summary' a custom slip/notice
by bugzilla-daemon＠bugs.koha-community.org 25 Feb '26

25 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11340 Catrina Berka <catrina(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |catrina(a)bywatersolutions.co | |m -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41941] New: change "alternative contact" to "alternate contact" on moremember.pl
by bugzilla-daemon＠bugs.koha-community.org 25 Feb '26

25 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41941 Bug ID: 41941 Summary: change "alternative contact" to "alternate contact" on moremember.pl Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: bdaeuber(a)cityoffargo.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com On the patron details page (cgi-bin/koha/members/moremember.pl) "Alternate address" and "Alternative contact" are listed. If you edit a patron, the sections are named "Alternate address" and "Alternate contact". Those should all match. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0