breadcrumb-the-shire/web/js/pages/admin-docs-index.js at 0392043ee3aba4e27898d980eeffeea7c56e6524 - breadcrumb-the-shire - Breadcrumb Gitea

fa/breadcrumb-the-shire

Files

fs ad8f30cb09 feat(security): add Content-Security-Policy headers with strict script-src

Eliminate all inline scripts to enable script-src 'self' without
'unsafe-inline', providing strong XSS mitigation via CSP.

Inline script removal:
- login.phtml: replace inline APP_ASSET_BASE with data-asset-base
  attribute + app-boot.js (matching default.phtml pattern)
- api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js
- docs: extract checkbox enablement to js/pages/admin-docs-index.js
- language-switcher: replace onchange handler with data-auto-submit
  attribute + js/components/app-auto-submit.js event listener

CSP policy (dev + prod nginx):
  default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data:; font-src 'self'; connect-src 'self';
  form-action 'self'; base-uri 'self'; frame-ancestors 'none';
  manifest-src 'self'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-13 19:24:10 +01:00

4 lines

152 B

JavaScript

Raw Blame History

	`document`
	`.querySelectorAll('.app-docs-content li > input[type="checkbox"][disabled]')`
	`.forEach((checkbox) => checkbox.removeAttribute('disabled'));`