From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 18 Jul 2026 16:30:31 +0200
Subject: Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports
---
 app/views/layouts/application.html.erb | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'app/views/layouts/application.html.erb')

diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index d7681aff..ca867ab8 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -18,12 +18,12 @@
     <%= auto_discovery_link_tag(:atom, '/rss/updates.xml', title: "ATOM") %>
     <%= auto_discovery_link_tag(:rss,  '/rss/updates.rdf', title: "RSS") %>
 
-    <script>
-      (function() { document.addEventListener("DOMContentLoaded", function() {
-        if (localStorage.getItem('override-prefers-color-scheme', false))
+    <%= javascript_tag nonce: true do %>
+      document.addEventListener("DOMContentLoaded", function() {
+        if (localStorage.getItem('override-prefers-color-scheme'))
           document.getElementById("light-mode").checked = true;
-      }); })();
-    </script>
+      });
+    <% end %>
 
   </head>
 
-- 
cgit v1.3