commit 6dd2c6d85b8c8caeb6c67fb7730a30605fdb366e
Author: Jake Deery <jake.deery@openfifth.co.uk>
Date:   Thu Jan 29 14:45:34 2026 +0000

    Bug 14962: Add hints as option on Vue FormElement
    
    This patch adds the ability to add hints to form elements in Vue, essential for the On Display module.
    Please see the test files commit for instructions on how to test this bundle of patches.
    
    Sponsored-by: ByWater Solutions
    Signed-of-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>

commit b936dc5d732ef20453b2003439c45f30fa358e28
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Mon Mar 16 16:41:13 2026 +0100

    Bug 38365: Fix Cypress tests
    
    ReferenceError: window is not defined
        at /kohadevbox/koha/t/cypress/plugins/dist/api-client.cjs.js:521:26
        at /kohadevbox/koha/t/cypress/plugins/dist/api-client.cjs.js:523:3
        at Object.<anonymous> (/kohadevbox/koha/t/cypress/plugins/dist/api-client.cjs.js:747:3)
        at Module._compile (node:internal/modules/cjs/loader:1521:14)
        at Module._extensions..js (node:internal/modules/cjs/loader:1623:10)
        at Object.require.extensions.<computed> [as .js] (/kohadevbox/Cypress/12.17.4/Cypress/resources/app/node_modules/ts-node/dist/index.js:851:20)
        at Module.load (node:internal/modules/cjs/loader:1266:32)
        at Function.Module._load (node:internal/modules/cjs/loader:1091:12)
        at Module.require (node:internal/modules/cjs/loader:1289:19)
        at require (node:internal/modules/helpers:182:18)
        at Object.<anonymous> (/kohadevbox/koha/t/cypress/plugins/api-client.js:11:23)
        at Module._compile (node:internal/modules/cjs/loader:1521:14)
        at Module._extensions..js (node:internal/modules/cjs/loader:1623:10)
        at Object.require.extensions.<computed> [as .js] (/kohadevbox/Cypress/12.17.4/Cypress/resources/app/node_modules/ts-node/dist/index.js:851:20)
        at Module.load (node:internal/modules/cjs/loader:1266:32)
        at Function.Module._load (node:internal/modules/cjs/loader:1091:12)
        at Module.require (node:internal/modules/cjs/loader:1289:19)
        at require (node:internal/modules/helpers:182:18)
        at Object.<anonymous> (/kohadevbox/koha/t/cypress/plugins/insertData.js:14:29)
        at Module._compile (node:internal/modules/cjs/loader:1521:14)
        at Module._extensions..js (node:internal/modules/cjs/loader:1623:10)
        at Object.require.extensions.<computed> [as .js] (/kohadevbox/Cypress/12.17.4/Cypress/resources/app/node_modules/ts-node/dist/index.js:851:20)

commit 1e1a446a554f9c7bc8808347793b9f7b77433fb1
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Mon Mar 16 16:19:07 2026 +0100

    Bug 38365: Fix xt/author/valid-templates.t
    
    13:12:25 #   Failed test '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc'
    13:12:25 #   at xt/author/valid-templates.t line 147.
    13:12:25 # undef error - : filter not found
    13:12:25
    13:12:25 #   Failed test '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc'
    13:12:25 #   at xt/author/valid-templates.t line 147.
    13:12:25 # undef error - : filter not found
    13:12:25
    13:12:25 #   Failed test [13:12:08] xt/author/valid-templates.t .................................................
    13:12:25 Dubious, test returned 28 (wstat 7168, 0x1c00)
    13:12:25 Failed 28/870 subtests
    13:12:26 '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/tinymce_i18n.inc'
    13:12:26 #   at xt/author/valid-templates.t line 147.
    13:12:26 # undef error - : filter not found
    13:12:28
    13:12:28 #   Failed test '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/erm_sushi_harvester.inc'
    13:12:28 #   at xt/author/valid-templates.t line 147.
    13:12:28 # undef error - : filter not found

commit f124229b23dac43ed79b7be31cc31144208557ef
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Mon Mar 16 14:07:57 2026 +0100

    Bug 38365: Fix Koha/Middleware/ContentSecurityPolicy.t
    
    GIT_INSTALL is not set and we get the wrong root.
    The test suite does not pass on a non git install anyway.

commit edb99983f71ae0191cfb84c89cd1fef373d0422d
Author: David Cook <dcook@prosentient.com.au>
Date:   Mon Mar 16 23:04:02 2026 +0000

    Bug 38365: Require a non-empty nonce in FrameworkPlugin.t
    
    Test plan:
    0. Apply the patch
    1. Run the following:
    prove t/db_dependent/FrameworkPlugin.t \
        t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t \
        t/db_dependent/Koha/UI/Form/Builder/Biblio.t \
        t/db_dependent/Koha/UI/Form/Builder/Item.t \
        t/db_dependent/Serials.t
    
    Squashed version of the following patches:
    
    Bug 38365: Fix Koha/UI/Form/Builder/Biblio.t
    
        #   Failed test at t/db_dependent/Koha/UI/Form/Builder/Biblio.t line 216.
        #                   '<script nonce="">
        # $(document).ready(function () {
        #
        # });
        # </script>
        # '
        #     doesn't match '(?^us:<script>.*</script>)'
        # Looks like you failed 1 test of 4.
    
    Bug 38365: Fix Koha/UI/Form/Builder/Item.t
    
     # There were 16 warning(s)
     #     Previous test 0 ''
     #     Use of uninitialized value $csp_nonce in concatenation (.) or string at /kohadevbox/koha/Koha/FrameworkPlugin.pm line 381.
     #  at /kohadevbox/koha/Koha/FrameworkPlugin.pm line 381.
    
    Bug 38365: Fix Serials.t
    
    Bug 38365: Fix FrameworkPlugin.t

commit 99cfa225372c562008615c64a4b41dd00b47bf38
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Fri Mar 13 10:43:14 2026 +0100

    Bug 38365: Do not rely on KOHA_HOME in tests
    
    We never do that in our tests, and KOHA_HOME is not defined for
    the kohadev-koha user in ktd.
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 046e0f7885a2d46ce2b0eb6af5ffd00dbc6ad478
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Tue Mar 10 12:34:55 2026 +0200

    Bug 38365: Adjust t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt
    
    This file now tidies after the patch
    "Make tidy.pl compatible with script elements with attributes"
    
    To test:
    1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit e00059dd1a117ae02cb9e2ae86eee9069ae3f74f
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Thu Mar 12 10:50:39 2026 +0100

    Bug 38365: Add CSP nonces to all inline script and style tags
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Amended-by: Jonathan Druart
    Regenerated the patch on top of bug 41324, using:
    perl misc/devel/add_csp_nonces.pl --apply
    ============================================================
    Summary:
      Files scanned:  881
      Files modified: 456
      Tags modified:  800
    ============================================================
    
    Also note that this manual change:
    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
    -    <script type="text/JavaScript">
    +    <script nonce="[% Koha.CSPNonce | $raw %]">
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 90f173ac6a079b1a179a3b8feebf36b3d0aaf597
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Mar 11 02:28:46 2026 +0000

    Bug 38365: Add context to Koha::Devel::Files in add_csp_nonces.pl
    
    The add_csp_nonces.pl file should use the exceptions in
    Koha::Devel::Files.
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 62f5411fb51871c067658186220b722b4f729a0e
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Fri Mar 6 10:37:28 2026 +0100

    Bug 38365: Add test_valuebuilder_popup.tt to the exception list
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 8b17f6158d0cff784ada720df542fd41e40b6323
Author: David Cook <dcook@prosentient.com.au>
Date:   Thu Mar 5 05:39:03 2026 +0000

    Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports
    
    By setting __webpack_nonce__ webpack/rspack will add the nonce to styles
    added using style-loader plugin.
    
    Also, stop fontawesome from auto injecting CSS elements, and instead
    manually import them so that they can be picked up by style-loader
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit e011f2f6e1aa6606d8e781e6b60ff98163da0da4
Author: David Cook <dcook@prosentient.com.au>
Date:   Thu Mar 5 05:38:12 2026 +0000

    Bug 38365: Make tidy.pl compatible with script elements with attributes
    
    tidy.pl will still tidy whitespace around script elements that have
    attributes like "nonce"
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 4d589b659dfa8e5f703fd288b3494ec0198b3903
Author: David Cook <dcook@prosentient.com.au>
Date:   Thu Mar 5 05:37:23 2026 +0000

    Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t
    
    This initialises the CSP nonce in the unit test so that
    t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt
    will get its script element rewritten correctly.
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit c42848609c1580f582a033e34ff33a9241c616dc
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Wed Mar 4 14:39:24 2026 +0200

    Bug 38365: Make swagger-cli happy
    
    Schema type [array,object] is not valid in OpenAPI version 2.
    
    There are two different CSP reporting directives.
    
    One is the now deprecated "report-uri" directive. Browsers typically send a single
    JSON object following the CSP2 specification.
    
    "report-uri" is deprecated in CSP3 in favor of the newer "report-to" directive. It
    is expected to contain an array of report objects.
    
    There are browser that do not yet support the "report-to" directive, so both
    directives should be supported.
    
    There are also variations among the "report-uri" format. See
    https://www.tollmanz.com/content-security-policy-report-samples/
    
    Because of these variations, it becomes quite complex to handle the most common
    cases in a single API endpoint.
    
    We could build two separate endpoints for both directives.
    
    Or we can accept any type of input and handle the variations in a single endpoint.
    This patch attempts to do that.
    
    Before this patch input parameters were validated by JSON::Validator. That is the
    normal and recommended way to build OpenAPI endpoints in Koha. After this patch we
    remove all input parameter restrictions from the OpenAPI spec, and simply accept
    any type of body.
    
    This means the controller will now always return a HTTP 204 regardless of the type
    of data passed to the controller. It instead truncates too long input before
    writing them into log files.
    
    As this is not an endpoint that developers will build new Koha clients for, we
    do not have to offer a very in-depth input parameter spec for this endpoint.
    
    To test:
    1. t/db_dependent/api/v1/public/csp_reports.t
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 265d204f097e9ab75e6f7af3b0096d3aefe36ba2
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Wed Mar 4 13:30:50 2026 +0200

    Bug 38365: (follow-up) Merge CSP middleware tests
    
    It seems the test outside of db_dependent required presence of database after all
    
    To test:
    1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit bba61e6bc9b2565cb010fed6a2e74a332009c7b4
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Wed Mar 4 11:23:46 2026 +0100

    Bug 38365: Use Koha::Devel::Files->ls_tt_files in add_csp_nonces.pl
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 18c0c012af096054adc5a3b24ba42610c9eecae0
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Wed Mar 4 11:14:52 2026 +0100

    Bug 38365: Add xt test
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 38475a3e359947de22fb11cbba2a800c699f6048
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Mar 4 02:52:11 2026 +0000

    Bug 38365: Switch from using ENV to package level variable for nonce caching
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 9f78d81bf0d3a5c0f4e6721335464258974dce6c
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Mar 4 02:46:18 2026 +0000

    Bug 38365: Add warning that intranet/staff interface is not ready for "enabled" mode yet
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 9fa86b090bc8f58b6964784f25e5198512dac3dd
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Mar 4 02:44:29 2026 +0000

    Bug 38365: Fix csp/csp-reports tag in API spec
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 87194ea1f27803401ab284179ce5af3c55f4b104
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Mar 4 02:39:12 2026 +0000

    Bug 38365: Remove old usage of Koha::Cache::Memory::Lite
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit e8afb55abde1f82d261a2bb100482686022a390e
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Mar 4 02:38:13 2026 +0000

    Bug 38365: Replace `use strict; use warnings;` with `use Modern::Perl`
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 87d0abc690f39092e4a9bf0afa66d55415dd6494
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Mar 4 02:37:17 2026 +0000

    Bug 38365: Remove old default values from koha-conf* files
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 4e5e2a342a6aafe0406a712d46a26b78952cd7c8
Author: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date:   Tue Mar 3 09:40:18 2026 +0100

    Bug 38365: Fix new_line_at_the_end_of_file QA failure
    
    [FAIL] api/v1/swagger/definitions/csp_report.yaml
       FAIL   new_line_at_the_end_of_file
                    Missing new line at the end of file, make sure your editor correctly reads .editorconfig ('insert_final_newline = true'). See bug 40541.
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit e32af26bca8b959cde0f366e79cca089080826b5
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Tue Feb 24 13:51:53 2026 +0200

    Bug 38365: (follow-up) Move default Content-Security-Policy value into Perl module, add tests
    
    To test:
    1. prove t/Koha/ContentSecurityPolicy.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit dc15cc3a04c8e01f364eb803eee015c66883c815
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Tue Feb 24 13:47:15 2026 +0200

    Bug 38365: (follow-up) Only get the nonce in templates if CSP is enabled, add tests
    
    To test:
    1. prove t/db_dependent/Koha/Template/Plugin/Koha.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit c8bfd03386a90f7ebd30cfef59e8ec7672f90a80
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Feb 18 01:11:35 2026 +0000

    Bug 38365: Only get the nonce in templates if CSP is enabled
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit da52fd9c6f25eb069e71c03ae4b2cb559877b4eb
Author: David Cook <dcook@prosentient.com.au>
Date:   Tue Feb 17 05:31:35 2026 +0000

    Bug 38365: Move default Content-Security-Policy value into Perl module
    
    By defining a default policy in the Perl module, we can easily update
    it over time. Using koha-conf.xml will just be for overrides, so people
    can manage their own there.
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit b14528e2f843b95ed4c54880964b3c1f93f817aa
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Tue Feb 10 21:12:49 2026 +0200

    Bug 38365: Disable the endpoint when CSP is disabled in KOHA_CONF
    
    To test:
    1. prove t/db_dependent/api/v1/public/csp_reports.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit bfe0d2f2c686e1a45b2cefbfbae6d64188ff7f49
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Tue Feb 10 20:54:53 2026 +0200

    Bug 38365: (QA follow-up) Fix param sample indentation
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 8da256080d6236a29e6c8b80849449ed0d246dd8
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Tue Feb 10 14:15:52 2026 +0200

    Bug 38365: Restore violated-directive
    
    The violated-directive is a historic name for the effective-directive field and
    contains the same value.
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 4e4eedf6ab6112a4526e34c7221c4d99fe06617a
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Tue Feb 10 13:45:09 2026 +0200

    Bug 38365: (follow-up) Add support for both CSP report syntaxes
    
    This patch fixes failing tests from the previous patch and adds more tests that
    cover multiple violation reports in one POST request.
    
    To test:
    1. prove t/db_dependent/api/v1/public/csp_reports.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit ffa7290fd16b2cb9561377920b8bc8880ad26386
Author: David Cook <dcook@prosentient.com.au>
Date:   Tue Feb 10 02:04:54 2026 +0000

    Bug 38365: Add support for both CSP report syntaxes
    
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit d3d0592eb70165fe55a06124871d435ff9f9dead
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Sun Feb 8 11:27:34 2026 +0200

    Bug 38365: Add application/reports+json as accepted Content-Type
    
    report-to directive uses application/reports+json
    
    To test:
    1. prove t/db_dependent/api/v1/public/csp_reports.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit a472e6354a0a89b8c94a298f37e370de37007273
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Thu Feb 5 16:31:11 2026 +0200

    Bug 38365: Set limitations on endpoint input
    
    This patch attempts to set some sane input limits to the CSP violation report.
    
    To test:
    1. Rebuild API
    redocly bundle --ext json api/v1/swagger/swagger.yaml --output api/v1/swagger/swagger_bundle.json
    2. t/db_dependent/api/v1/public/csp_reports.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit b027a437c1ccf212c8ba27a30545522d35698127
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Wed Feb 4 16:42:34 2026 +0200

    Bug 38365: Use report-to with Reporting-Endpoints
    
    report-uri is deprecated, replaced by report-to and Reporting-Endpoints.
    
    To test:
    1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit a7b51e670130be310f0c0d2d9c5d1ee56d2c447e
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Thu Feb 5 10:44:33 2026 +0200

    Bug 38365: Add default log4perl configuration
    
    This patch adds the default configuration to log4perl.conf.
    
    Note we are passing a non-standard interface 'csp' to Koha::Logger. This is to
    avoid log entries from propagating up to api-error.log.
    
    To test:
    1. prove t/db_dependent/api/v1/public/csp_reports.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit a26a1f4dc7a0df1aa7201ed05a8eaaeda36ad4df
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Feb 4 02:00:44 2026 +0000

    Bug 38365: Fix nonce caching and add to framework plugin scripts
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit f80451023e8779474296811270dbd394c9028141
Author: David Cook <dcook@prosentient.com.au>
Date:   Wed Feb 4 00:06:23 2026 +0000

    Bug 38365: Add <style to add_csp_nonces.pl to add nonce to style elements
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 497162620443c0633bb13640b9c9d282122857bf
Author: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date:   Mon Feb 2 10:34:19 2026 +0000

    Bug 38365: Add CSP violation reporting API endpoint
    
    Add /api/v1/public/csp-reports endpoint to receive and log
    Content-Security-Policy violation reports from browsers.
    
    When CSP is configured with a report-uri directive pointing to this
    endpoint, browsers will POST violation reports whenever a CSP rule
    is violated. These reports are logged using Koha's logging system
    for administrator review.
    
    Features:
    - Public endpoint (no authentication required, as browsers send
      these reports automatically)
    - Logs violations at WARN level with key details (violated directive,
      blocked URI, document URI, source location)
    - Logs full report at DEBUG level for detailed analysis
    - Accepts both application/csp-report and application/json content types
    
    Configuration example (in koha-conf.xml csp_header_value):
      ...; report-uri /api/v1/public/csp-reports
    
    Log4perl configuration to capture CSP violations:
      log4perl.logger.api.csp = WARN, CSP
      log4perl.appender.CSP = Log::Log4perl::Appender::File
      log4perl.appender.CSP.filename = /var/log/koha/csp-violations.log
      log4perl.appender.CSP.layout = PatternLayout
      log4perl.appender.CSP.layout.ConversionPattern = [%d] %m%n
    
    Also updates koha-conf.xml documentation with CSP configuration guidance.
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit e8d11cc10227cd4244e31a776d19799f6e5b9547
Author: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date:   Mon Feb 2 10:12:55 2026 +0000

    Bug 38365: Add script to insert CSP nonces into templates
    
    Add misc/devel/add_csp_nonces.pl which automatically adds CSP nonce
    attributes to inline <script> tags in Koha templates.
    
    The script:
    - Finds all .tt and .inc files in koha-tmpl/
    - Adds nonce="[% Koha.CSPNonce | $raw %]" to inline scripts
    - Skips external scripts (those with src= attribute)
    - Skips scripts that already have nonce= attribute
    - Skips third-party library files in lib/ and vendor/
    
    Usage:
      perl misc/devel/add_csp_nonces.pl          # Dry run
      perl misc/devel/add_csp_nonces.pl --apply  # Apply changes
    
    This script enables easy backporting of CSP nonce support to older
    Koha versions by running it against their template directories.
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit ececcb535fbf1117c603521cd90aa7d9484464a7
Author: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date:   Mon Feb 2 10:02:23 2026 +0000

    Bug 38365: Fix no-op //= operator on variable declarations
    
    The //= (defined-or assignment) operator on a freshly declared
    variable is a no-op since the variable is always undef at that
    point. Replace with simple = assignment.
    
    Affects header_name(), header_value(), and is_enabled() methods.
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 70933f08434a722e7cf9cc1ef8479e2ec3784b99
Author: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date:   Mon Feb 2 09:59:54 2026 +0000

    Bug 38365: Increase CSP nonce entropy to 128+ bits
    
    OWASP recommends CSP nonces have at least 128 bits of entropy.
    The previous 10-character alphanumeric nonce provided only ~59 bits
    (log2(62^10) ≈ 59.5).
    
    Increase to 22 characters which provides ~130 bits of entropy
    (log2(62^22) ≈ 130.5), exceeding the OWASP recommendation.
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 47a28d62f9626371222a0a85e2a77cf9d95229aa
Author: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date:   Mon Feb 2 09:59:09 2026 +0000

    Bug 38365: Integrate CSP middleware into Plack apps
    
    Add Koha::Middleware::ContentSecurityPolicy to the middleware chain
    in both app.psgi and the Debian plack.psgi template.
    
    Without this integration, the CSP feature would not work - the
    middleware was created but never activated. This adds it to:
    - app.psgi (development/git install)
    - debian/templates/plack.psgi (opac, intranet, and intranet_svc mounts)
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 4301202a2d6be931068c9cd4902cbb1cb0e7a5d3
Author: David Cook <dcook@prosentient.com.au>
Date:   Tue Jan 20 00:39:34 2026 +0000

    Bug 38365: Add "style-src-attr 'unsafe-inline';" to default policy
    
    This change adds "style-src-attr 'unsafe-inline';" to the default CSP policy.
    
    The reason is that we have a lot of inline styles throughout Koha,
    and it will take a long time to clean those up. Also, the WYSIWYG/TinyMCE
    editor injects inline styles, so it might not be possible to forbid
    unsafe inline styles in Koha.
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit e750e6d1f5e7a6d41a0793b00b0b1049154cd11b
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Fri Jan 16 15:02:13 2026 +0200

    Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce
    
    This patch adds a new Template plugin method, Koha.CSPNonce, that can be used to
    attach the Content Security Policy nonce into our templates.
    
    To test:
    1. prove t/Koha/Middleware/ContentSecurityPolicy.t
    2. prove t/db_dependent/Koha/Template/Plugin/Koha.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit e160ed8b06704d24cc4cad220d8e44de1700a3bd
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Wed Nov 26 22:24:37 2025 +0200

    Bug 38365: Add Koha::Middleware::ContentSecurityPolicy
    
    This patch adds a new Perl package, Koha::Middleware::ContentSecurityPolicy.
    
    It is called for each Plack requests, and its job is to add the
    Content-Security-Policy[-Report-Only] header with the configured value.
    
    To test:
    1. prove t/Koha/Middleware/ContentSecurityPolicy.t
    2. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit b2fcc61bda0fbab51569779cd963aea08dc98ee5
Author: Lari Taskula <lari.taskula@hypernova.fi>
Date:   Mon Oct 27 20:31:12 2025 +0200

    Bug 38365: Add Koha::ContentSecurityPolicy
    
    This patch adds a new Perl package, Koha::ContentSecurityPolicy.
    
    It provides the following methods:
    
      $csp->header_name
    
    Returns the name of the CSP header, based on koha-conf configuration.
    
      $csp->header_value
    
    Returns the value of the CSP header, based on koha-conf configuration.
    
      $csp->is_enabled
    
    Returns true or false, based on koha-conf configuration.
    
      $csp->nonce
    
    Generates or sets, and returns the nonce. A CSP nonce is a random token that is
    used both in the inline scripts and the Content-Security-Policy[-Report-Only]
    response header.
    
    To test:
    1. prove t/Koha/ContentSecurityPolicy.t
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 7fcae0c8236356c8833bdbd15694b389a63998ff
Author: David Cook <dcook@prosentient.com.au>
Date:   Tue Nov 11 03:56:26 2025 +0000

    Bug 38365: Remove unsafe CSP rules
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

commit 65873238ced2dae96f4f5dcba75050b9e2e97ecd
Author: David Cook <dcook@prosentient.com.au>
Date:   Fri Oct 31 04:09:22 2025 +0000

    Bug 38365: add nonce to style-src and add default csp to Debian koha-conf.xml template
    
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
    Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
    Signed-off-by: David Cook <dcook@prosentient.com.au>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
    
    Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>