diff --git a/src/.ruff.toml b/src/.ruff.toml index ed08c4a0b02aee10c13d0b164a9bbf80b9150412..54daa1c3a8f7b6a98264bccfadb9198332bd2d2a 100644 --- a/src/.ruff.toml +++ b/src/.ruff.toml @@ -93,6 +93,7 @@ section-order = [ "django_bootstrap5", "django_rich", "djangorestframework", + "csp", "modeltranslation", "ragelimit", "rules", diff --git a/src/core/views/sso.py b/src/core/views/sso.py index ec25485126cb842701c7cdc8d3980e2d5197fb45..fb4e9e4092bf1590910621389179dc516ff1c563 100644 --- a/src/core/views/sso.py +++ b/src/core/views/sso.py @@ -2,10 +2,10 @@ import calendar import json import logging -from csp.decorators import csp_update from oauth2_provider.models import get_access_token_model from oauth2_provider.views import AuthorizationView, ClientProtectedScopedResourceView +from csp.decorators import csp_update from django.conf import settings from django.core.exceptions import ObjectDoesNotExist from django.http import HttpResponse diff --git a/src/plainui/views/events.py b/src/plainui/views/events.py index ed0bffa3f80f055a9a56b56ea5f9d09153bf0bdb..6a07a4f0dee3d97e2f98c000a5085f0d37c97f4f 100644 --- a/src/plainui/views/events.py +++ b/src/plainui/views/events.py @@ -5,9 +5,11 @@ __all__ = ( 'UpcomingView', ) +from csp.decorators import csp_update from django.contrib.contenttypes.models import ContentType from django.shortcuts import get_object_or_404 from django.urls import reverse +from django.utils.decorators import method_decorator from django.views.generic.base import TemplateView from core.models import ( @@ -37,6 +39,7 @@ class AssembliesEventsView(ConferenceRequiredMixin, TemplateView): return context +@method_decorator(csp_update(SCRIPT_SRC="'unsafe-eval'"), name='get') class EventView(ConferenceRequiredMixin, TemplateView): template_name = 'plainui/event.html.j2' diff --git a/src/plainui/views/general.py b/src/plainui/views/general.py index ee3b24ad628111fd64fb10800bb263f9f5a342fb..943fa1f6093c8e48ef0da96b3ecfb6119596b200 100644 --- a/src/plainui/views/general.py +++ b/src/plainui/views/general.py @@ -10,10 +10,12 @@ __all__ = ( from datetime import timedelta +from csp.decorators import csp_update from django.contrib.contenttypes.models import ContentType from django.shortcuts import get_list_or_404, redirect from django.urls import reverse from django.utils import timezone +from django.utils.decorators import method_decorator from django.utils.timezone import now from django.views.generic.base import TemplateView @@ -58,6 +60,7 @@ class LandingView(ConferenceRequiredMixin, TemplateView): return context +@method_decorator(csp_update(SCRIPT_SRC="'unsafe-eval'"), name='get') class IndexView(ConferenceRequiredMixin, TemplateView): template_name = 'plainui/index.html.j2' diff --git a/src/plainui/views/rooms.py b/src/plainui/views/rooms.py index 689660b792bc8f6526906fdacbdf696e73e2a1be..503c387386f4d844832b8d3985e2acb2b984cb1c 100644 --- a/src/plainui/views/rooms.py +++ b/src/plainui/views/rooms.py @@ -4,9 +4,11 @@ __all__ = ( ) +from csp.decorators import csp_update from django.contrib import messages from django.db.models import QuerySet from django.http import HttpResponseRedirect +from django.utils.decorators import method_decorator from django.utils.translation import gettext from django.views.generic import DetailView @@ -24,6 +26,7 @@ from plainui.views.utils import ( ) +@method_decorator(csp_update(SCRIPT_SRC="'unsafe-eval'"), name='get') class RoomView(ConferenceRequiredMixin, DetailView): model = Room template_name = 'plainui/room.html.j2'