Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

Browse Source

The delete prompts on the webhook page were inline onsubmit handlers.
Each delete form now carries its question in a data-confirm attribute,
which one submit listener in static/js/app.js asks. The three style
attributes became Tailwind classes, with tailwind.css regenerated, and
the x-cloak rule moved to style.css. The policy now sends
script-src 'self' and style-src 'self'.

The browser test now answers a target's delete prompt no and then yes,
and loads the webhook list, settings and profile pages under the
policy. The README states the policy as sent.

Model: opus-5-5

...

This commit is contained in:

sneak

2026-10-15 09:46:04 +00:00

parent f14fe02011

commit 3b1029f65c

15 changed files with 212 additions and 94 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

static/css/tailwind.css

+1 -1

File diff suppressed because one or more lines are too long