darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-07-14 02:09:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use csp nonces for inline scripts and styles

Browse Source
This commit is contained in:
Ryan Ahearn
2023-03-07 16:08:51 -05:00
parent e8e8c889d6
commit 2a6bc62003
5 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/__init__.py
View File

@@ -30,7 +30,6 @@ from notifications_utils.formatters import (
get_lines_with_normalised_whitespace,
)
from notifications_utils.recipients import format_phone_number_human_readable
from notifications_utils.sanitise_text import SanitiseASCII
from werkzeug.exceptions import HTTPException as WerkzeugHTTPException
from werkzeug.exceptions import abort
from werkzeug.local import LocalProxy
@@ -147,6 +146,7 @@ navigation = {
'org_navigation': OrgNavigation(),
}
def _csp(config):
asset_domain = config['ASSET_DOMAIN']
logo_domain = config['LOGO_CDN_DOMAIN']

2
app/templates/admin_template.html
View File

@@ -19,7 +19,7 @@
<link rel="stylesheet" media="print" href="{{ asset_url('stylesheets/print.css') }}" />
{% block extra_stylesheets %}
{% endblock %}
<style>
<style nonce="{{ csp_nonce() }}">
.govuk-header__container { border-color: {{header_colour}} }
</style>
{% if g.hide_from_search_engines %}

2
app/templates/main_template.html
View File

@@ -28,7 +28,7 @@
<!-- <meta property="og:image" content="{{ assetUrl | default('/assets') }}/images/govuk-opengraph-image.png"> -->
</head>
<body class="govuk-template__body {{ bodyClasses }}">
<script>document.body.className = ((document.body.className) ? document.body.className + ' js-enabled' : 'js-enabled');</script>
<script nonce="{{ csp_nonce() }}">document.body.className = ((document.body.className) ? document.body.className + ' js-enabled' : 'js-enabled');</script>
{% block bodyStart %}{% endblock %}
{% block skipLink %}

2
app/templates/partials/tour.html
View File

@@ -4,7 +4,7 @@
<p class="heading-medium">Try sending yourself this example</p>
<div class="govuk-grid-row bottom-gutter {% if help != '1' %}greyed-out-step{% endif %}">
<div class="govuk-grid-column-one-sixth">
<p class="heading-large" style="float: left;">1.</p>
<p class="heading-large">1.</p>
</div>
<div class="govuk-grid-column-five-sixths">
<p class="govuk-body">