Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Johannes
 |  Maron
 Type:  New feature  |   Status:  closed
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:  fixed
 Keywords:  CSP, nonce, admin| Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Comment (by Jacob Walls ):

 In [changeset:"9b4433948714d5c43bab96b08bb6618c22512000" 9b44339]:
 {{{#!CommitTicketReference repository=""
 revision="9b4433948714d5c43bab96b08bb6618c22512000"
 Refs #36825 -- Fixed regression in CSPSeleniumTestCase.

 The CSP report test relied on the debug view having a CSP error,
 which has been fixed in 3e4e0db. This commit added a custom
 view to reintroduce the same error to verify the reporting
 behavior.

 Follow-up to 3e4e0db66961a48a080ff3ff91f6c0d954261366.
 }}}
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019e4595118c-3a55d81a-6bec-4766-86aa-1699141cdf17-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Johannes
 |  Maron
 Type:  New feature  |   Status:  closed
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:  fixed
 Keywords:  CSP, nonce, admin| Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Jacob Walls ):

 * resolution:   => fixed
 * status:  assigned => closed

Comment:

 In [changeset:"3e4e0db66961a48a080ff3ff91f6c0d954261366" 3e4e0db]:
 {{{#!CommitTicketReference repository=""
 revision="3e4e0db66961a48a080ff3ff91f6c0d954261366"
 Fixed #36825 -- Extended admin templates so CSP nonce is included if
 available.

 Error pages, admin, and registration templates were updated to use
 `{% csp_nonce %}` on their explicit `

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Johannes
 |  Maron
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by blighj):

 * stage:  Accepted => Ready for checkin

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019e228c7345-6cd7b71e-b100-496d-976a-c1149087decb-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Johannes
 |  Maron
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Johannes Maron):

 * needs_better_patch:  1 => 0
 * needs_tests:  1 => 0

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019e20e47660-76ffee2e-9c88-48bc-916b-a5814fc8b17f-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Johannes
 |  Maron
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  1|  Patch needs improvement:  1
Easy pickings:  0|UI/UX:  0
-+-
Changes (by blighj):

 * needs_better_patch:  0 => 1
 * needs_tests:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019e20af8857-a0cb898a-588b-48ca-9965-717d375cc622-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Johannes
 |  Maron
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Johannes Maron):

 * has_patch:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019e17c26147-93e5bc3f-a7c9-4276-982b-4c9fb85d5934-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Johannes
 |  Maron
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Jacob Walls):

 * owner:  Antoliny => Johannes Maron

Comment:

 Setting owner from an indication on one of the PRs.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019e031b8fbb-a47efbb6-cc82-48d2-9018-1b6c9945d53f-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Changes (by Natalia Bidart):

 * has_patch:  1 => 0
 * needs_better_patch:  1 => 0

Comment:

 Inspiration PR is at https://github.com/django/django/pull/21010 with
 meaningful and valuable review comments. Anyone working on this ticket
 should fully study that PR first.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019e0309e0c5-54968676-8ca6-47f8-b50b-35c1739873f0-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Changes (by Jacob Walls):

 * needs_better_patch:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019dd6152655-d0b7040f-f30a-42a2-8be8-fbc6b3f300d7-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Changes (by Natalia Bidart):

 * needs_better_patch:  1 => 0

Comment:

 There is [https://github.com/django/django/pull/21010 a PR] that addresses
 this ticket in the more simple way (a tag just like you proposed Antoliny,
 so I will make you a co-author). But I still think it'd be worth seeing if
 we could have the admin using more of `Media` instead all the explicit
 `script` and `link` manually written elements.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d2f8dd296-18903959-c15d-4e61-9ecd-547f5a1619d2-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Comment (by Natalia Bidart):

 There is a new and relevant forum post re-thinking the whole CSP nonce
 approach here: https://forum.djangoproject.com/t/csp-nonce-support-for-
 form-media-classes-and-admin-scripts/44698
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d26138984-c2ae6f6a-ac19-40dd-86dc-a4199ff1899b-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Changes (by Natalia Bidart):

 * needs_better_patch:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d22c71886-297f8c6b-df20-47ec-82b6-ffea796c21f9-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Changes (by Antoliny):

 * needs_better_patch:  1 => 0

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d1b4cf6fb-e621528a-2f2e-4623-8481-51c282507067-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Comment (by Antoliny):

 [https://github.com/django/django/pull/20969 New PR]
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d1b48608c-a9f2cee2-4f77-4240-8605-17d002618f21-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Comment (by Antoliny):

 > Hey Antoliny, your proposal makes sense. If you have any ideas or
 opinions for how to solve the other ticket, please comment there. Thanks!

 Thank you, Natalia! I'll start by addressing the scripts in the templates
 first, and then figure out the next steps depending on how the nonce
 support lands in Form.media.

 Thanks for the quick response!
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d1b055521-641b9e65-e08c-41d4-9f35-66fab9fde718-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Comment (by Natalia Bidart):

 Replying to [comment:16 Antoliny]:
 > Hi Natalia and Jacob! I was looking into starting this work, but I
 noticed that some scripts in the admin are generated via `Form.media`, so
 would it be better to wait for this ticket to land first before
 proceeding?
 >
 > https://code.djangoproject.com/ticket/36784

 Hey Antoliny, your proposal makes sense. If you have any ideas or opinions
 for how to solve the other ticket, please comment there. Thanks!
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d1b0274dc-764325b5-acab-47ca-8c0f-65cd3bcebf54-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Comment (by Antoliny):

 Hi Natalia and Jacob! I was looking into starting this work, but I noticed
 that some scripts in the admin are generated via `Form.media`, so would it
 be better to wait for this ticket to land first before proceeding?

 https://code.djangoproject.com/ticket/36784
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d1a5e461a-4f3ce6f3-a435-4ce7-a519-a382312bbf61-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  Antoliny
 Type:  New feature|   Status:  assigned
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  1  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  1
Easy pickings:  0  |UI/UX:  0
---+
Changes (by Antoliny):

 * owner:  Kundan Yadav => Antoliny

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019cbda25bcf-51399a60-c8b2-4e69-ba47-096662781672-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  1
Easy pickings:  0|UI/UX:  0
-+-
Comment (by Kundan Yadav):

 Replying to [comment:13 Natalia Bidart]:
 > Replying to [comment:11 Kundan Yadav]:
 > > hey is there anything left or wrong in the pr ?
 >
 > Hello Kundan, we appreciate your eagerness to contribute! Your branch is
 in the
 
[https://code.djangoproject.com/query?has_patch=1&needs_better_patch=0&needs_docs=0&needs_tests=0&stage=Accepted&status=!closed&order=changetime&desc=1
 review queue] and will be looked at when someone is available.
 >
 > Please note that Django is a community driven project and we rely on
 volunteers to make not only code contributions, but also other
 contributions such as PR reviews. If you have any availability, please
 consider contributing in other areas apart from code. For more details,
 see https://docs.djangoproject.com/en/6.0/internals/contributing/new-
 contributors/.
 >
 > Lastly, please make sure that your PR is of the highest quality
 possible, to avoid back and forth on issues that could have been caught by
 following the
 [https://docs.djangoproject.com/en/dev/internals/contributing/writing-code
 /submitting-patches/#patch-review-checklist Contribution checklist].


 i will not use llm and my  next pr will be better than before
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019bb8da2fdc-71b0eb20-3879-4a74-b5d5-1d72b8fd152d-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  1
Easy pickings:  0|UI/UX:  0
-+-
Comment (by Natalia Bidart):

 Replying to [comment:11 Kundan Yadav]:
 > hey is there anything left or wrong in the pr ?

 Hello Kundan, we appreciate your eagerness to contribute! Your branch is
 in the
 
[https://code.djangoproject.com/query?has_patch=1&needs_better_patch=0&needs_docs=0&needs_tests=0&stage=Accepted&status=!closed&order=changetime&desc=1
 review queue] and will be looked at when someone is available.

 Please note that Django is a community driven project and we rely on
 volunteers to make not only code contributions, but also other
 contributions such as PR reviews. If you have any availability, please
 consider contributing in other areas apart from code. For more details,
 see https://docs.djangoproject.com/en/6.0/internals/contributing/new-
 contributors/.

 Lastly, please make sure that your PR is of the highest quality possible,
 to avoid back and forth on issues that could have been caught by following
 the [https://docs.djangoproject.com/en/dev/internals/contributing/writing-
 code/submitting-patches/#patch-review-checklist Contribution checklist].
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019bb89bbe8f-ccc0a331-f8c6-443e-8b33-f560a77a102b-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  1
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Jacob Walls):

 * needs_better_patch:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019bb897e1f6-b7b557f2-c3e4-4bf0-9aea-43f973636ce4-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Comment (by Kundan Yadav):

 hey is there anything left or wrong in the pr ?
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019bb875ba60-d8ae4dc1-50c4-480d-a5e2-80213b192dd9-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Kundan Yadav):

 * needs_docs:  1 => 0

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019bae4873f7-86f99950-17ce-4320-85f0-2dc54033f316-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  1
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Kundan Yadav):

 * needs_better_patch:  1 => 0
 * needs_tests:  1 => 0

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b99cfab26-9313e48a-c56a-4401-adc6-ce7e89a33f15-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  1
  Needs tests:  1|  Patch needs improvement:  1
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Natalia Bidart):

 * needs_better_patch:  0 => 1
 * needs_docs:  0 => 1
 * needs_tests:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b8fd5629b-7b40645d-f211-4b6f-a51f-53eee9f8b035-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Kundan Yadav):

 * has_patch:  0 => 1

Comment:

 https://github.com/django/django/pull/20494
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b8a865e1f-889c8f36-db0c-49ac-a2b0-d26cd02df96f-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Antoliny):

 * cc: Antoliny (added)

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b4dc68541-1a651246-d63e-4af0-880e-cab48957f17a-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Comment (by Rob Hudson):

 This is a subtle issue with regards to the nature of `strict-dynamic`.

 The admin templates would need to add conditional nonce attributes to all
 script tags (both external and inline). For example:

 Current (admin/base.html:9)

 {{{
   
 }}}

 Should be:

 {{{
   
 }}}

 This would allow things to work in the following 4 scenarios. Currently it
 seems Django 6.0
 1. when CSP middleware is not enabled (nonce is falsy, not added to header
 or script tags)
 2. when CSP is enabled without nonces (nonce not accessed, not added to
 header or script tags)
 3. when CSP uses nonces (nonce added to both tag and header)
 4. when CSP uses nonces with `CSP.STRICT_DYNAMIC` (nonce added to both tag
 and header)

 The difference between 3 and 4 is that 3 would allow host-based allowlists
 and keyword allowlists to work. When `CSP.STRICT_DYNAMIC`, host-based
 allowlists and keyword (e.g. `CSP.SELF`) allowlists are ignored, so admin
 scripts would then require nonces.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b4d52a385-0aae82f2-73df-4fa0-b369-4fe54fe6eac2-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
-+-
 Reporter:  Carsten Fuchs|Owner:  Kundan
 |  Yadav
 Type:  New feature  |   Status:  assigned
Component:  contrib.admin|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:  CSP, nonce, admin| Triage Stage:  Accepted
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Kundan Yadav):

 * owner:  (none) => Kundan Yadav
 * status:  new => assigned

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b4cb3336d-c09e6303-cdf6-4ad2-a3a2-49ab7b7a1a2b-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  (none)
 Type:  New feature|   Status:  new
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Comment (by Carsten Fuchs):

 Hello Natalia,

 thanks for accepting the ticket. I’d love to help and I can try, but
 realistically this might land closer to Django 61.0 than 6.1 — I don’t
 know the admin codebase well enough to move that quickly. 🙂 So, no
 promises.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b4c67fddb-069f9a4b-566a-4642-beec-02ceae337c26-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+
 Reporter:  Carsten Fuchs  |Owner:  (none)
 Type:  New feature|   Status:  new
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Changes (by Natalia Bidart):

 * cc: Rob Hudson (added)
 * stage:  Unreviewed => Accepted
 * type:  Uncategorized => New feature

Comment:

 Hello Carsten!

 Thank you for taking the time to create this report. I have confirmed your
 findings:

 {{{
 Content-Security-Policy: The page’s settings blocked a script (script-src-
 elem) at http://localhost:9000/static/admin/js/theme.js from being
 executed because it violates the following directive: “script-src 'strict-
 dynamic'” admin
 Content-Security-Policy: The page’s settings blocked a script (script-src-
 elem) at http://localhost:9000/static/admin/js/nav_sidebar.js from being
 executed because it violates the following directive: “script-src 'strict-
 dynamic'”
 }}}

 I am accepting this ticket as a new feature for 6.1, subject to volunteer
 contributions, to add nonce-based CSP support in the admin. Would you like
 to work on a branch?
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b4c5528bf-05524c06-3aa0-4bcd-ad7b-4a25a38d4eaf-00%40eu-central-1.amazonses.com.

Re: [Django] #36825: CSP nonces are not applied in the Django admin

[Django]

#36825: CSP nonces are not applied in the Django admin
---+--
 Reporter:  Carsten Fuchs  |Owner:  (none)
 Type:  Uncategorized  |   Status:  new
Component:  contrib.admin  |  Version:  6.0
 Severity:  Normal |   Resolution:
 Keywords:  CSP, nonce, admin  | Triage Stage:  Unreviewed
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+--
Description changed by Carsten Fuchs:

Old description:

> When a Content Security Policy is configured in `settings.py` with
> directives that require script nonces, for example:
>
> {{{
> #!python
> SECURE_CSP = {
> "object-src": [CSP.NONE],
> "base-uri": [CSP.NONE],
> "script-src": [CSP.NONCE, CSP.STRICT_DYNAMIC],
> }
> }}}
>
> the Django admin interface stops working because the inline and linked
> scripts used by the admin do not receive a nonce, resulting in CSP
> violations.
>
> **Expected behavior:**
> When CSP nonces are enabled, the Django admin should either automatically
> apply nonces to its scripts, or there should be a documented and
> supported way to make the admin compatible with nonce-based CSP
> configurations.

New description:

 When a Content Security Policy is configured in `settings.py` with
 directives that require script nonces, for example:

 {{{
 #!python
 SECURE_CSP = {
 "object-src": [CSP.NONE],
 "base-uri": [CSP.NONE],
 "script-src": [CSP.NONCE, CSP.STRICT_DYNAMIC],
 }
 }}}

 the Django admin interface stops working because the linked scripts used
 by the admin do not receive a nonce, resulting in CSP violations.

 **Expected behavior:**
 When CSP nonces are enabled, the Django admin should either automatically
 apply nonces to its scripts, or there should be a documented and supported
 way to make the admin compatible with nonce-based CSP configurations.

--
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019b4c506793-29adcf3a-3578-4375-8242-933d55b32cd6-00%40eu-central-1.amazonses.com.