Skip to content

Conversation

@juspence
Copy link
Contributor

(Copied from #7960, but nonce removed to avoid conflicts with user-defined policies)

Remove a few instances of inline CSS which could trigger Content Security Policies (CSPs) and replace with classes where required.

Part of #6069.

I've left JavaScript alone as it's covered by #5740 and #7016 (which I think are duplicates of each other?).

@juspence juspence self-assigned this Nov 29, 2022
</nav>
{% endif %}

<div class="request-info" style="clear: both" aria-label="{% trans "request info" %}">
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clear: both was already in request-info.

@juspence juspence requested a review from auvipy November 29, 2022 18:40
@juspence
Copy link
Contributor Author

@auvipy This is the same as #7960, but with the CSP nonce bit removed to avoid problems.

I will leave this open a few days. Please let me know if you'd like to review again or if I should merge.

@auvipy auvipy added this to the 3.15 milestone Nov 30, 2022
Copy link
Collaborator

@auvipy auvipy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would you mind sharing the screenshots please after this changes?

@juspence
Copy link
Contributor Author

juspence commented Dec 1, 2022

@auvipy Sorry for the delayed response. Here's before:
Screenshot from 2022-12-01 22-49-56

And after:
Screenshot from 2022-12-01 22-53-57

@juspence juspence requested a review from auvipy December 1, 2022 22:55
@Mogost
Copy link

Mogost commented Jul 11, 2024

@juspence @auvipy
In #7960 there was support for nonce.

<style{% if request.csp_nonce %} nonce="{{request.csp_nonce}}"{% endif %}>{{ code_style }}</style>

I do not understand the reason for removing this support in this PR

(Copied from #7960, but nonce removed to avoid conflicts with user-defined policies)

If there is no request.csp_nonce there is no conflict because it does not add nonce attr. But if the project follows the strictest CSP with nonce BrowserableAPI is still broken.
Also, the PR and release notes include

Add CSP nonce where it might be required and is available.

Which is a lie.

@mrazzari
Copy link

mrazzari commented Jan 24, 2025

This PR uses a bootstrap class for floats (pull-left) but the clear:both is included in bootstrap-tweaks.css.

This means if the user overrides the default theme as documented, the clear is gone, and all content boxes get stacked horizontally.

Solution: Description and paginator should be wrapped in a <div class="clearfix">.

Screenshot of the bug using "Flatly" Bootstrap theme:
Boxes are ugly and stacked horizontally, instead of vertically

@auvipy
Copy link
Collaborator

auvipy commented Jan 25, 2025

Would you mind sending a PR to fix this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants