From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 18 Jul 2026 16:30:31 +0200
Subject: Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports
---
 public/javascripts/admin_interface.js | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

(limited to 'public/javascripts/admin_interface.js')

diff --git a/public/javascripts/admin_interface.js b/public/javascripts/admin_interface.js
index c0e2d9c..b7bdc10 100644
--- a/public/javascripts/admin_interface.js
+++ b/public/javascripts/admin_interface.js
@@ -82,10 +82,8 @@ $(document).ready(function () {
   });
 
   $(document).ajaxSend(function(event, request, settings) {
-    if (typeof(AUTH_TOKEN) == "undefined") return;
-    // settings.data is a serialized string like "foo=bar&baz=boink" (or null)
-    settings.data = settings.data || "";
-    settings.data += (settings.data ? "&" : "") + "authenticity_token=" + encodeURIComponent(AUTH_TOKEN);
+    var meta = document.querySelector("meta[name='csrf-token']");
+    if (meta) request.setRequestHeader("X-CSRF-Token", meta.content);
   });
 
 });
-- 
cgit v1.3