vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

QUAL Add the CSP nonce on the drag and drop script tag (#39466)

Browse source 
The script tag emitted by dragAndDropFileUpload() was the only inline script of
the page without the nonce, so it was blocked by a Content Security Policy that
allows the inline scripts through it, and the drag and drop was then silently
inert on every card that enables it.

Same form as the ~25 other inline script tags of main.inc.php. getNonce() is
stable within a request, and the attribute is ignored by the browser when no
policy is defined.
This commit is contained in:
VIAL-GOUTEYRON Quentin 2026-08-13 02:29:49 +02:00 committed by GitHub
parent f8557c0ccd
commit b35b9cdc3c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/core/lib/files.lib.php
View file

@ -4049,7 +4049,7 @@ function dragAndDropFileUpload($htmlname)
$out = "";
$out .= '<div id="'.$htmlname.'Message" class="dragDropAreaMessage hidden"><span>'.img_picto("", 'download').'<br>'.$langs->trans("DropFileToAddItToObject").'</span></div>';
$out .= "\n<!-- JS CODE TO ENABLE DRAG AND DROP OF FILE -->\n";
$out .= "<script>";
$out .= '<script nonce="'.getNonce().'">';
$out .= '
jQuery(document).ready(function() {
var enterTargetDragDrop = null;