fs
ad8f30cb09
Eliminate all inline scripts to enable script-src 'self' without 'unsafe-inline', providing strong XSS mitigation via CSP. Inline script removal: - login.phtml: replace inline APP_ASSET_BASE with data-asset-base attribute + app-boot.js (matching default.phtml pattern) - api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js - docs: extract checkbox enablement to js/pages/admin-docs-index.js - language-switcher: replace onchange handler with data-auto-submit attribute + js/components/app-auto-submit.js event listener CSP policy (dev + prod nginx): default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; manifest-src 'self' Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
17 lines
445 B
JavaScript
17 lines
445 B
JavaScript
const container = document.getElementById('swagger-ui');
|
|
|
|
if (container && window.SwaggerUIBundle) {
|
|
window.SwaggerUIBundle({
|
|
url: container.dataset.specUrl || '',
|
|
dom_id: '#swagger-ui',
|
|
deepLinking: false,
|
|
displayRequestDuration: true,
|
|
filter: true,
|
|
docExpansion: 'list',
|
|
supportedSubmitMethods: [],
|
|
tryItOutEnabled: false,
|
|
presets: [window.SwaggerUIBundle.presets.apis],
|
|
layout: 'BaseLayout',
|
|
});
|
|
}
|