https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43843
--- Comment #9 from Frédéric Demians <[email protected]> --- EXPLANATION AND REASONING This bug prevents deploying an OPAC protected by CSP with a language other than English: the JavaScripttranslation mechanism breaks. The culprit is Gettext.js. Rather than fixing it, the patches switch to another library: Tannin. Why replace Gettext.jsrather than fix it? * eval is in the design of Gettext.js. It builds a function to process plural forms. Fixing it means maintaining our own fork of a library from 2008. * Fixing it means writing our own code. To drop eval, Koha would have to writea parser of the Plural-Forms expressions, and maintain it. Tannin does exactly that, and is already widely tested: it is the engine of @wordpress/i18n. * Adding 'unsafe-eval' to the CSP is not an option: it would defeat what CSP is for. The CSP blocks eval and "new Function" because they turn a string into code. * Less code: Tannin is small (2 KB), Gettext.js is huge (45 KB). * Low risk: the JavaScript translation API (__(), __n(), etc.) doesn't change. The po and locale_data.js files don't have to be regenerated: only the translated templates must be updated, as for any template change. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
