Bug: Page results doesn't work with backend-CSP

[SusiSorglos]

The cs-seo backend-module (typo3/module/web/cs-seo/page-results?id=[...]) display no results when [SYS][features][security.backend.enforceContentSecurityPolicy] = true. This happens because the cs_seo JavaScripts are blocked by the TYPO3 CSP restrictions in the backend. If I set [SYS][features][security.backend.enforceContentSecurityPolicy] to "false" it works. Can you please fix this because disabling backend-CSP is not a good option for security reasons. Tested in TYPO3 12.4.20

[mhirdes]

I merged the PR. May you can test?

[SusiSorglos]

Thanks for the patch! The result for the first level (= the selected page) is now visible. But I can't change the page-depth per selectbox to display also the results of the subpages. I think the CSP blockes the JavaScript in the onchange-attribute of the select-box:

<select onchange="this.form.submit();" class="form-select" id="depth" name="depth">

It seems also that the angular.js is blocked by the CSP.

I got the following error-messages:

• Content-Security-Policy: Die Einstellungen der Seite haben die Ausführung eines JavaScript-Evals (script-src) blockiert, da es gegen folgende Direktive verstößt: "script-src 'self' 'nonce-2jsnLu51D-d6SoQ0OVqIK862US7F1j8qQKuinWAYB-LNFQ81ED3Fcw' 'report-sample'" (es fehlt 'unsafe-eval') angular.js:1108:7
• Content-Security-Policy: Die Einstellungen der Seite haben die Ausführung eines Event-Handlers (script-src-attr) blockiert, da es gegen folgende Direktive verstößt: "script-src 'self' 'nonce-2jsnLu51D-d6SoQ0OVqIK862US7F1j8qQKuinWAYB-LNFQ81ED3Fcw' 'report-sample'" - Source: this.form.submit(); page-results
• Content-Security-Policy: Die Einstellungen der Seite haben die Ausführung eines Event-Handlers (script-src-attr) blockiert, da es gegen folgende Direktive verstößt: "script-src 'self' 'nonce-2jsnLu51D-d6SoQ0OVqIK862US7F1j8qQKuinWAYB-LNFQ81ED3Fcw' 'report-sample'" - Source: this.form.submit(); page-results

Adding the onchange-function via "addEventListener" could possibly solve the problem with "this.form.submit()".

[SusiSorglos]

Sorry, I accidentally closed the issue...