https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832
Bug ID: 43832
Summary: Default CSP external cover images on the OPAC
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Architecture, internals, and plumbing
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Target Milestone: ---
Since bug 38365, the OPAC can send a Content-Security-Policy header. When
csp_mode is set to "enabled" and csp_header_value is left empty, Koha uses a
hard-coded default policy (Koha/ContentSecurityPolicy.pm):
default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_';
style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline';
img-src 'self' data:; font-src 'self'; object-src 'none'
This policy doesn't depend on system preferences. With it, every cover
image service that loads its images, or its data, from another host stops
working, without any message in the staff interface. Only local covers
(OPACLocalCoverImages, OPACCustomCoverImages pointing to
the Koha server) are displayed.
koha-testing-docker enables the OPAC CSP, so this can be seen there:
1. In koha-conf.xml, set <csp_mode>enabled</csp_mode> for the OPAC, with an
empty <csp_header_value> (the default in KTD), and restart_all.
2. Enable OPACAmazonCoverImages (or GoogleJackets, OpenLibraryCovers).
3. Open the detail page of a record with an ISBN on the OPAC.
4. No cover is displayed. The browser console reports CSP violations.
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
