search

t3brightside / vimeovideo

TYPO3 CMS extension for Vimeovideo content.
https://t3brightside.com/
0 stars 1 forks source link

Content Security Policy #2

Open sunfish opened 3 months ago

sunfish commented 3 months ago

Dear Tanel, in my typo3 12.4.11 installation using vimeovideo 1.1.0 I try to add a vimeo video from fileadmin vimeo record. ajax-dispatcher.js sends an error: EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'nonce-HBqM27mCpBWfCcY8KRQYGCJmCeAeJ6YuhbFEcHdE4SfN7GpGYEXiyA' 'report-sample'".

Can anyone give me a tip on how to solve this problem? do I need to set a special content security policy directive? 'unsafe-eval' can't be the right solution?

t3brightside commented 3 months ago

It's due to start and end time field evaluation that's inline right now and should be moved to external JS file. Will be done sooner or later, need to take time for it...

dsg1-wolf commented 3 months ago

Seeing how time seems to be an issue, is there a good, reliable workaround? Or a hint as to where this CSP is set and, hence, could be altered?

t3brightside commented 3 months ago

I'm not sure there is one at the moment, not without altering the code.

t3brightside commented 3 months ago

You can give it a try with the latest dev version now. No official release yet.