View Issue Detail

ID	Project	Category	Submitted / Last Updated
02197	UserSpice	Triage	2025-10-27 08:31:30 / 2025-11-09 12:21:07
Reported	Espresso Dan	Resolved By	Dan Hoover
Priority	none	Reported	5.9.6
Status	resolved fixed	Resolution Version and Commit	5.9.7
Summary	Functionality suggestion - Nonced scripts
Description	The current security updates are a big move forwards for UserSpice. Currently, the ability to apply a robust CSP is limited due to the use of inline scripts in many admin functions. I currently deal with this in my production sites by generating a CSP nonce within a session. This works well for validating inline scripts. Can I suggest that adding a basic function to the frontend to place a nonce in inline scripts in the user interface would enable the use of a better CSP for most users, as 'unsafe-inline' is definitely considered poor practice now and without it the userspice admin frontend is effectively broken.

2 weeks ago

I have started this in 6.0. It's a big adjustment that I wouldn't enforce by default, but I'm working on it. Getting all the plugins updated would be tricky.