Skip to content
Snippets Groups Projects
Commit 84495f36 authored by Oliver Hader's avatar Oliver Hader Committed by Oliver Hader
Browse files

[BUGFIX] Grant inline scripts & styles via CSP in admin panel output

The admin panel uses Symfony's `HtmlDumper` to output data - which is
adding inline JavaScript and StyleSheet elements. To be compatible with
CSP those elements need to be allowed with a nonce attribute.

This change relies on a merged pull request for Symfony v6.3:
https://github.com/symfony/symfony/pull/49977

Executed commands:
composer req symfony/var-dumper:^6.3
composer req symfony/var-dumper:^6.3 \
  -d typo3/sysext/adminpanel --no-update

Resolves: #100456
Releases: main, 12.4
Change-Id: I7fcea196107959db85257c7d735f85a9e78839d2
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79204


Tested-by: default avatarcore-ci <typo3@b13.com>
Tested-by: default avatarOliver Hader <oliver.hader@typo3.org>
Reviewed-by: default avatarOliver Hader <oliver.hader@typo3.org>
parent 06f1f6d9
Branches
Tags
No related merge requests found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment