From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 18 Jul 2026 16:30:31 +0200 Subject: Emit a report-only Content-Security-Policy with nonced inline scripts - dark-mode restore now travels nonced, the admin constants likewise - AUTH_TOKEN deleted in favour of the csrf meta tag - new report collector at /csp_reports --- app/views/layouts/admin.html.erb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'app/views/layouts/admin.html.erb') diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb index 0856a0f6..e220bebd 100644 --- a/app/views/layouts/admin.html.erb +++ b/app/views/layouts/admin.html.erb @@ -7,19 +7,18 @@ <%= csrf_meta_tags %> <%= "#{params[:controller]} | #{params[:action]}" %> - <%= javascript_tag "var AUTH_TOKEN = #{form_authenticity_token.inspect};" if protect_against_forgery? %> <%= javascript_include_tag 'admin_bundle' %> <%= tinymce_assets %> - + <% end %> -- cgit v1.3