https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43843 Bug ID: 43843 Summary: OPAC JavaScript translations break when the Content-Security-Policy is enabled Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: f.demians@tamil.fr QA Contact: testopia@bugs.koha-community.org Depends on: 38365 Target Milestone: --- When the Content-Security-Policy is enabled on the OPAC (csp_mode "enabled" in koha-conf.xml) and the OPAC is displayed in any language other than English, all JavaScript translation functions fail: __(), __x(), __n(), __nx(), __p()... As a consequence, every script that translates a string breaks: DataTables tables (kohaTable) are not initialized, messages and dialogs are not displayed, etc. The browser console shows, on every page: Uncaught EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'nonce-...' Uncaught TypeError: Cannot read properties of undefined (reading 'gt') at i18n.js Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 [Bug 38365] Add Content-Security-Policy HTTP header to HTML responses -- You are receiving this mail because: You are watching all bug changes.