Mercurial > p > roundup > code
diff roundup/cgi/templating.py @ 5217:17b213eab274
Add nonce to embedded script references.
This should allow these scripts to execute with a nonce-.... content
security policy (csp). However there is still a lot of inline
javascript that a web developer needs to look at and rewrite the
inline javascript (onsubmit, onclick ..) to be applied by a nonce
authorized javascript library that adds event listeners.
Ref: https://csp.withgoogle.com/docs/adopting-csp.html#refactor-inline-event-handlers-and-javascript-uris
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Mar 2017 21:08:30 -0400 |
| parents | f4b6a2a3e605 |
| children | 24945480d24c |
line wrap: on
line diff
--- a/roundup/cgi/templating.py Wed Mar 22 22:03:01 2017 -0400 +++ b/roundup/cgi/templating.py Thu Mar 23 21:08:30 2017 -0400 @@ -2904,7 +2904,7 @@ def base_javascript(self): return """ -<script type="text/javascript"> +<script nonce="%s" type="text/javascript"> submitted = false; function submit_once() { if (submitted) { @@ -2920,7 +2920,7 @@ HelpWin.focus () } </script> -"""%self.base +"""%(self._client.client_nonce,self.base) def batch(self, permission='View'): """ Return a batch object for results from the "current search"