https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832
--- Comment #7 from Frédéric Demians <[email protected]> --- Created attachment 208346 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208346&action=edit Bug 43832: Document CSP sources for OPAC cover image services The hard-coded Content-Security-Policy only allows images served by Koha. With csp_mode set to "enabled", the OPAC cover image services loading their images, or their data with JSONP, from another host stop working: Amazon, Google, Open Library, Syndetics and Coce. This patch: - documents, in koha-conf.xml and in the koha-conf template of the Debian packages, the sources to add to a custom csp_header_value for each of these services, with an example of OPAC policy; - adds a note to the OPAC cover image preferences, pointing to this documentation: OPACAmazonCoverImages, GoogleJackets, OpenLibraryCovers, SyndeticsCoverImages and OpacCoce. The wording of the note is Owen's. Only the OPAC is concerned: koha-conf.xml warns that the staff interface is not yet production ready for the "enabled" mode, so the CSP doesn't apply there for now. The staff interface preferences can get the same documentation when it does. Test plan: 1. In koha-conf.xml (/etc/koha/sites/kohadev/koha-conf.xml in KTD), set <csp_mode>enabled</csp_mode> for the OPAC with an empty <csp_header_value>, and restart_all. 2. Enable OPACAmazonCoverImages, and open the detail page of a record with an ISBN on the OPAC (biblionumber=6 in KTD sample data): no cover, the browser console reports a CSP violation on img-src. 3. Disable OPACAmazonCoverImages and repeat with GoogleJackets, then OpenLibraryCovers: no cover, a CSP violation on script-src. 4. Repeat with OpacCoce, CoceHost=https://coce.tamil.fr, CoceProviders=aws,gb,ol: no cover, a CSP violation on script-src. 5. Apply this patch and read the new "Cover images" paragraph of the CSP documentation in etc/koha-conf.xml. 6. Copy the example policy into <csp_header_value>, replacing coce.example.org by coce.tamil.fr, and add to script-src https://books.google.com https://openlibrary.org. restart_all. 7. Repeat steps 2 to 4: the covers are displayed, without CSP violation. 8. Check that debian/templates/koha-conf-site.xml.in has the same paragraph. 9. Go to Administration > System preferences > Enhanced content, and check that the five preferences above have a note about the OPAC Content Security Policy below their description. Syndetics needs a client code and could not be tested; its host, secure.syndetics.com, is the one used by the OPAC templates. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
