Skip to content

Add content security policy - #26020

Draft
AdrienClairembault wants to merge 1 commit into
glpi-project:mainfrom
AdrienClairembault:csp
Draft

AdrienClairembault wants to merge 1 commit into
glpi-project:mainfrom
AdrienClairembault:csp

Conversation

@AdrienClairembault

@AdrienClairembault AdrienClairembault commented Oct 21, 2026 •

Copy link
Copy Markdown
Member

Work in progress.

Breaking changes for plugins:

  • No javascript: links
  • No inline event handlers (e.g. onclick=xxx)
  • <script> tags requires a nonce attribute. It is added automatically if the script is:
    • In a .twig file
    • In a renderFromStringTemplate() call
    • Generated by Html::script()
    • Generated by Html::scriptBlock()

@AdrienClairembault
AdrienClairembault force-pushed the csp branch 5 times, most recently from c790f94 to a8c5ad3 Compare October 21, 2026 13:58

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant