Project

General

Profile

Actions
Copy link

Bug #103673

closed

CSP: Admin Panel submodule script tag does not get nonce attached

Added by Chris Müller about 1 month ago. Updated 29 days ago.

Status:
Resolved
Priority:
Should have
Assignee:
Chris Müller
Category:
AdminPanel
Target version:
Candidate for patchlevel
Start date:
2024-04-19
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
12
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

With EXT:schema, I am providing a custom admin panel module/submodule with JavaScript attached. The script tag does not get a nonce attribute for that submodule which results in a CSP violation when not allowing 'self', only nonce for scripts.

The reason for this: in ResourceUtility class the $attributes array (which holds the "useNonce" configuration) is not passed to the getAdditionalResourcesForModules() call.

Actions
Copy link

Also available in: Atom PDF