From b35b9cdc3c8261a86833ba828a8fb4643419085d Mon Sep 17 00:00:00 2001
From: VIAL-GOUTEYRON Quentin <quentin.vial-gouteyron@atm-consulting.fr>
Date: Thu, 13 Aug 2026 02:29:49 +0200
Subject: [PATCH] QUAL Add the CSP nonce on the drag and drop script tag
 (#39466)

The script tag emitted by dragAndDropFileUpload() was the only inline script of
the page without the nonce, so it was blocked by a Content Security Policy that
allows the inline scripts through it, and the drag and drop was then silently
inert on every card that enables it.

Same form as the ~25 other inline script tags of main.inc.php. getNonce() is
stable within a request, and the attribute is ignored by the browser when no
policy is defined.
---
 htdocs/core/lib/files.lib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php
index 6cc9c787518..84b2b1644d8 100644
--- a/htdocs/core/lib/files.lib.php
+++ b/htdocs/core/lib/files.lib.php
@@ -4049,7 +4049,7 @@ function dragAndDropFileUpload($htmlname)
 	$out = "";
 	$out .= '<div id="'.$htmlname.'Message" class="dragDropAreaMessage hidden"><span>'.img_picto("", 'download').'<br>'.$langs->trans("DropFileToAddItToObject").'</span></div>';
 	$out .= "\n<!-- JS CODE TO ENABLE DRAG AND DROP OF FILE -->\n";
-	$out .= "<script>";
+	$out .= '<script nonce="'.getNonce().'">';
 	$out .= '
 		jQuery(document).ready(function() {
 			var enterTargetDragDrop = null;