https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 Bug ID: 43832 Summary: Default CSP external cover images on the OPAC Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: f.demians@tamil.fr QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Since bug 38365, the OPAC can send a Content-Security-Policy header. When csp_mode is set to "enabled" and csp_header_value is left empty, Koha uses a hard-coded default policy (Koha/ContentSecurityPolicy.pm): default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' This policy doesn't depend on system preferences. With it, every cover image service that loads its images, or its data, from another host stops working, without any message in the staff interface. Only local covers (OPACLocalCoverImages, OPACCustomCoverImages pointing to the Koha server) are displayed. koha-testing-docker enables the OPAC CSP, so this can be seen there: 1. In koha-conf.xml, set <csp_mode>enabled</csp_mode> for the OPAC, with an empty <csp_header_value> (the default in KTD), and restart_all. 2. Enable OPACAmazonCoverImages (or GoogleJackets, OpenLibraryCovers). 3. Open the detail page of a record with an ISBN on the OPAC. 4. No cover is displayed. The browser console reports CSP violations. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.