https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832
--- Comment #3 from Owen Leonard <[email protected]> --- Created attachment 208330 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208330&action=edit Bug 43832: Document CSP sources for cover image services The hard-coded Content-Security-Policy only allows images served by Koha. With csp_mode set to "enabled", the OPAC cover image services loading their images, or their data with JSONP, from another host stop working: Amazon, Google, Open Library, Syndetics and Coce. This patch documents, in koha-conf.xml and in the koha-conf template of the Debian packages, the sources to add to a custom csp_header_value for each of these services, with an example of OPAC policy. Test plan: 1. In koha-conf.xml (/etc/koha/sites/kohadev/koha-conf.xml in KTD), set <csp_mode>enabled</csp_mode> for the OPAC with an empty <csp_header_value>, and restart_all. 2. Enable OPACAmazonCoverImages, and open the detail page of a record with an ISBN on the OPAC (biblionumber=6 in KTD sample data): no cover, the browser console reports a CSP violation on img-src. 3. Disable OPACAmazonCoverImages and repeat with GoogleJackets, then OpenLibraryCovers: no cover, a CSP violation on script-src. 4. Repeat with OpacCoce, CoceHost=https://coce.tamil.fr, CoceProviders=aws,gb,ol: no cover, a CSP violation on script-src. 5. Apply this patch and read the new "Cover images" paragraph of the CSP documentation in etc/koha-conf.xml. 6. Copy the example policy into <csp_header_value>, replacing coce.example.org by coce.tamil.fr, and add to script-src https://books.google.com https://openlibrary.org. restart_all. 7. Repeat steps 2 to 4: the covers are displayed, without CSP violation. 8. Check that debian/templates/koha-conf-site.xml.in has the same paragraph. Syndetics needs a client code and could not be tested; its host, secure.syndetics.com, is the one used by the OPAC templates. Signed-off-by: Owen Leonard <[email protected]> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
