From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 18 Jul 2026 16:30:31 +0200 Subject: Emit a report-only Content-Security-Policy with nonced inline scripts - dark-mode restore now travels nonced, the admin constants likewise - AUTH_TOKEN deleted in favour of the csrf meta tag - new report collector at /csp_reports --- app/views/layouts/admin.html.erb | 5 ++--- app/views/layouts/application.html.erb | 10 +++++----- 2 files changed, 7 insertions(+), 8 deletions(-) (limited to 'app/views/layouts') diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb index 0856a0f6..e220bebd 100644 --- a/app/views/layouts/admin.html.erb +++ b/app/views/layouts/admin.html.erb @@ -7,19 +7,18 @@ <%= csrf_meta_tags %> <%= "#{params[:controller]} | #{params[:action]}" %> - <%= javascript_tag "var AUTH_TOKEN = #{form_authenticity_token.inspect};" if protect_against_forgery? %> <%= javascript_include_tag 'admin_bundle' %> <%= tinymce_assets %> - + <% end %> diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index d7681aff..ca867ab8 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -18,12 +18,12 @@ <%= auto_discovery_link_tag(:atom, '/rss/updates.xml', title: "ATOM") %> <%= auto_discovery_link_tag(:rss, '/rss/updates.rdf', title: "RSS") %> - + }); + <% end %> -- cgit v1.3