WWSympa: Apply Content Security Policy on scripts (#1122) - Githubissues

sympa-community / sympa

Sympa, Mailing List Management Software

https://www.sympa.community/sympa

GNU General Public License v2.0

246 stars 97 forks source link

WWSympa: Apply Content Security Policy on scripts (#1122) #1580

Open ikedas opened 1 year ago

ikedas commented 1 year ago

This PR aims to ensure that the following things meet the Content Security Policy.

[x] inline javascript generated by head_javascript.tt2.
[x] inline javascript included in confirm_action.tt2, create_list_request.tt2, lists.tt2 and stats.tt2.
[x] "onclick" event handler in HTML: compose_mail.tt2, request_topic.tt2 and viewmod.tt2.
[x] inline javascript for email obfuscation generated by setting spam_protection and/or web_archive_spam_protection parameter as javascript.

This may fix #1122 .