fs ad8f30cb09 feat(security): add Content-Security-Policy headers with strict script-src ...

Eliminate all inline scripts to enable script-src 'self' without
'unsafe-inline', providing strong XSS mitigation via CSP.

Inline script removal:
- login.phtml: replace inline APP_ASSET_BASE with data-asset-base
  attribute + app-boot.js (matching default.phtml pattern)
- api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js
- docs: extract checkbox enablement to js/pages/admin-docs-index.js
- language-switcher: replace onchange handler with data-auto-submit
  attribute + js/components/app-auto-submit.js event listener

CSP policy (dev + prod nginx):
  default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data:; font-src 'self'; connect-src 'self';
  form-action 'self'; base-uri 'self'; frame-ancestors 'none';
  manifest-src 'self'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-13 19:24:10 +01:00

..

app-breadcrumb.phtml

big restructure

2026-02-11 19:28:12 +01:00

app-confirm-dialog.phtml

agent foundation

2026-03-06 00:44:52 +01:00

app-danger-zone-delete-field.phtml

major update

2026-03-04 15:56:58 +01:00

app-details-aside-actions.phtml

variablen und empty states

2026-03-12 16:47:53 +01:00

app-details-aside-audit.phtml

add composer-unused, comprehensive docs, and project restructure

2026-02-22 15:27:35 +01:00

app-details-aside-ids.phtml

add composer-unused, comprehensive docs, and project restructure

2026-02-22 15:27:35 +01:00

app-details-titlebar.phtml

variablen und empty states

2026-03-12 16:47:53 +01:00

app-details-validation-summary.phtml

major update

2026-03-04 15:56:58 +01:00

app-empty-state.phtml

variablen und empty states

2026-03-12 16:47:53 +01:00

app-flash.phtml

baseline

2026-02-04 23:31:53 +01:00

app-footer.phtml

page update

2026-03-12 14:09:06 +01:00

app-form-info-tile.phtml

Fix tenant SSO status mode and refactor status UI tiles

2026-03-12 10:01:24 +01:00

app-language-switcher.phtml

feat(security): add Content-Security-Policy headers with strict script-src

2026-03-13 19:24:10 +01:00

app-list-filters.phtml

major update

2026-03-04 15:56:58 +01:00

app-list-purge-action.phtml

major update

2026-03-04 15:56:58 +01:00

app-list-tabs.phtml

major update

2026-03-04 15:56:58 +01:00

app-list-titlebar.phtml

major update

2026-03-04 15:56:58 +01:00

app-main-aside-icon-bar.phtml

aside anapssungen

2026-03-05 13:07:43 +01:00

app-main-aside.phtml

empty states

2026-03-13 09:49:11 +01:00

app-session-warning-dialog.phtml

feat(session): preserve intended URL across session timeout and add expiry warning dialog

2026-03-13 14:28:49 +01:00

app-tile.phtml

big restructure

2026-02-11 19:28:12 +01:00

app-topbar.phtml

fixed wrong warning with single tenant

2026-03-12 12:22:36 +01:00

app-visibility-status-field.phtml

add composer-unused, comprehensive docs, and project restructure

2026-02-22 15:27:35 +01:00

auth-help-links.phtml

ui/ux login optimization

2026-03-07 14:10:36 +01:00

auth-logo.phtml

fix(session): preserve intended URL across session timeout with remember-me

2026-03-13 18:28:13 +01:00

auth-step-indicator.phtml

further things around login

2026-03-07 21:21:47 +01:00