UserSpice Bugs

ID	Project	Category	Submitted / Last Updated
02338	UserSpice	Triage	2026-04-27 22:24:04
Reported	Espresso Dan	Assigned To	Unassigned
Priority	none	Reported	6.0.8
Status	new	Resolution Version and Commit
Summary	Security dashboard CSP vs Admin Interface use of onsubmit()
Description	Recent Userspice security updates encourage the use of a CSP. Although a CSP can allow unsafe-inline, doing so undermines a CSP's protection against XSS. The use of onclick() and onsubmit() should be depreciated in the admin interface in favour of a CSP friendly approach. Current functions appear to be: authenticatePasskey confirm copyToClipboard displayNotifications generateMetadataModal registerPasskey setDirty setTimeout showEditForm toggleBackupForm usDeleteMenu usDeleteMenuItem window.location.href Which would imply that around 13 event handler/class pairs and some additional data-attributes attached to current forms could be used to refactor the current admin interface into a CSP-functional solution.

Yesterday

Appologies for the mixed write-up. Was typing while investigation. Ignore the specific refernces to onclick() and onsubmit() - the functions provides are what should be addressed. I have begun to implement a local solution, but am reluctant to continue as this feels like a change that any future update to US would likely revert.
Yesterday

Yeah. I agree. I can't force a CSP on existing sites. It would break literally everything... But I am working on going through the code. I will probably send you an email as I get into this and working on the next version and we can put our heads together on a couple things. Thanks for bringing this up.
10 hours ago

Feel free - I've sent suggestions in the past on other issues and have no problem contributing to assist in tasks like this.

View Issue Detail