Add csp exceptions for voc-player

- Add unsafe-eval to the pages with the player
  Needed until the player removes the unsafe-eval

src/.ruff.toml

@@ -93,6 +93,7 @@ section-order = [
     "django_bootstrap5",
     "django_rich",
     "djangorestframework",
+    "csp",
     "modeltranslation",
     "ragelimit",
     "rules",

src/core/views/sso.py

@@ -2,10 +2,10 @@ import calendar
 import json
 import logging
 
-from csp.decorators import csp_update
 from oauth2_provider.models import get_access_token_model
 from oauth2_provider.views import AuthorizationView, ClientProtectedScopedResourceView
 
+from csp.decorators import csp_update
 from django.conf import settings
 from django.core.exceptions import ObjectDoesNotExist
 from django.http import HttpResponse

src/plainui/views/events.py

@@ -5,9 +5,11 @@ __all__ = (
     'UpcomingView',
 )
 
+from csp.decorators import csp_update
 from django.contrib.contenttypes.models import ContentType
 from django.shortcuts import get_object_or_404
 from django.urls import reverse
+from django.utils.decorators import method_decorator
 from django.views.generic.base import TemplateView
 
 from core.models import (
@@ -37,6 +39,7 @@ class AssembliesEventsView(ConferenceRequiredMixin, TemplateView):
         return context
 
 
+@method_decorator(csp_update(SCRIPT_SRC="'unsafe-eval'"), name='get')
 class EventView(ConferenceRequiredMixin, TemplateView):
     template_name = 'plainui/event.html.j2'
 

src/plainui/views/general.py

@@ -10,10 +10,12 @@ __all__ = (
 
 from datetime import timedelta
 
+from csp.decorators import csp_update
 from django.contrib.contenttypes.models import ContentType
 from django.shortcuts import get_list_or_404, redirect
 from django.urls import reverse
 from django.utils import timezone
+from django.utils.decorators import method_decorator
 from django.utils.timezone import now
 from django.views.generic.base import TemplateView
 
@@ -58,6 +60,7 @@ class LandingView(ConferenceRequiredMixin, TemplateView):
         return context
 
 
+@method_decorator(csp_update(SCRIPT_SRC="'unsafe-eval'"), name='get')
 class IndexView(ConferenceRequiredMixin, TemplateView):
     template_name = 'plainui/index.html.j2'
 

src/plainui/views/rooms.py

@@ -4,9 +4,11 @@ __all__ = (
 )
 
 
+from csp.decorators import csp_update
 from django.contrib import messages
 from django.db.models import QuerySet
 from django.http import HttpResponseRedirect
+from django.utils.decorators import method_decorator
 from django.utils.translation import gettext
 from django.views.generic import DetailView
 
@@ -24,6 +26,7 @@ from plainui.views.utils import (
 )
 
 
+@method_decorator(csp_update(SCRIPT_SRC="'unsafe-eval'"), name='get')
 class RoomView(ConferenceRequiredMixin, DetailView):
     model = Room
     template_name = 'plainui/room.html.j2'