https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832
--- Comment #17 from Paul Derscheid <[email protected]> --- Created attachment 209470 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209470&action=edit Bug 43832: (QA follow-up) Document CSP sources for OPACCustomCoverImages Custom cover images are loaded from the CustomCoverImagesURL host, and from any host it redirects to, which the hard-coded CSP blocks too. - document the img-src entry in koha-conf.xml and the Debian template - add the CSP note to the CustomCoverImages preferences Test plan: 1. Keep the OPAC CSP of the previous patch's test plan, with OpenLibraryCovers disabled 2. Set OPACCustomCoverImages to "Show" and CustomCoverImagesURL to {024$a} 3. Add to record biblionumber=2 (The ideas behind the chess openings) a 024 8_ $a https://picsum.photos/id/237/200/300 (redirected to fastly.picsum.photos) 4. Open /cgi-bin/koha/opac-detail.pl?biblionumber=2: no cover, the console reports: Loading the image 'https://picsum.photos/id/237/200/300' violates the following Content Security Policy directive: "img-src 'self' data: https://covers.openlibrary.org https://archive.org https://*.us.archive.org";. The action has been blocked. 5. Apply this patch, add https://picsum.photos https://fastly.picsum.photos to img-src as documented, restart_all 6. Reload biblionumber=2: the custom cover is displayed, no CSP violation 7. Administration > System preferences > Enhanced content: the custom cover images preferences show the CSP note Assisted-by: Opus 5.5 (Anthropic) Signed-off-by: Paul Derscheid <[email protected]> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
