From 4ea7c9f7d298168faa29cdc197e86721e4e2b467 Mon Sep 17 00:00:00 2001
From: gw3000 <weissenbaeck@posteo.de>
Date: Wed, 26 Jul 2023 23:03:30 +0200
Subject: [PATCH] django csp

---
 app/aviary/templates/aviary/aviary_all.html   |  2 +-
 app/bird/templates/bird/bird_all.html         |  2 +-
 app/bird/templates/bird/bird_inactive.html    |  2 +-
 app/core/settings.py                          | 33 +++++++++++++++----
 app/costs/templates/costs/costs_all.html      |  2 +-
 .../templates/rescuer/rescuer_all.html        |  2 +-
 6 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/app/aviary/templates/aviary/aviary_all.html b/app/aviary/templates/aviary/aviary_all.html
index a08e7fb..b0213e7 100644
--- a/app/aviary/templates/aviary/aviary_all.html
+++ b/app/aviary/templates/aviary/aviary_all.html
@@ -14,7 +14,7 @@
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/dataTables.responsive.min.js"></script>
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/responsive.bootstrap5.min.js"></script>
 
-<script>
+<script nonce="{{request.csp_nonce}}">
     $(document).ready(function () {
         let table = $('#t__aviary_all').DataTable({
             language: {
diff --git a/app/bird/templates/bird/bird_all.html b/app/bird/templates/bird/bird_all.html
index d88bd41..dde5b7b 100644
--- a/app/bird/templates/bird/bird_all.html
+++ b/app/bird/templates/bird/bird_all.html
@@ -14,7 +14,7 @@
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/dataTables.responsive.min.js"></script>
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/responsive.bootstrap5.min.js"></script>
 
-<script>
+<script nonce="{{request.csp_nonce}}">
   $(document).ready(function () {
     let table = $('#t__bird_all').DataTable({
       language: {
diff --git a/app/bird/templates/bird/bird_inactive.html b/app/bird/templates/bird/bird_inactive.html
index 8f16ab3..2c9374b 100644
--- a/app/bird/templates/bird/bird_inactive.html
+++ b/app/bird/templates/bird/bird_inactive.html
@@ -14,7 +14,7 @@
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/dataTables.responsive.min.js"></script>
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/responsive.bootstrap5.min.js"></script>
 
-<script>
+<script nonce="{{request.csp_nonce}}">
   $(document).ready(function () {
     let table = $('#t__bird_all').DataTable({
       language: {
diff --git a/app/core/settings.py b/app/core/settings.py
index ae33511..b6a96a7 100644
--- a/app/core/settings.py
+++ b/app/core/settings.py
@@ -25,12 +25,6 @@ CSRF_TRUSTED_ORIGINS = ["https://fbf.nabu-jena.de"]
 # Cookies
 SESSION_COOKIE_SECURE = True
 
-# DJANGO Content Security Policy
-CSP_DEFAULT_SRC = ("'self'",)
-CSP_STYLE_SRC = ("'self'",)
-CSP_SCRIPT_SRC = ("'self'",)
-CSP_IMG_SRC = ("'self'",)
-CSP_FONT_SRC = ("'self'",)
 
 # HTTPS
 SECURE_HSTS_SECONDS = 0
@@ -92,8 +86,35 @@ MIDDLEWARE = [
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "csp.middleware.CSPMiddleware",
 ]
 
+# DJANGO Content Security Policy
+CSP_DEFAULT_SRC = (
+    "'self'",
+    "https://cdn.datatables.net",
+)
+CSP_STYLE_SRC = (
+    "'self'",
+    "https://bootswatch.com",
+    "https://cdn.datatables.net",
+    "https://cdnjs.cloudflare.com",
+    "https://fonts.googleapis.com",
+)
+CSP_SCRIPT_SRC = (
+    "'self'",
+    "https://cdn.datatables.net",
+    "https://cdn.jsdelivr.net",
+    "https://code.jquery.com",
+)
+CSP_INCLUDE_NONCE_IN = ["script-src"]
+CSP_IMG_SRC = ("'self'",)
+CSP_FONT_SRC = (
+    "'self'",
+    "https://fonts.gstatic.com",
+    "https://cdnjs.cloudflare.com",
+)
+
 ROOT_URLCONF = "core.urls"
 
 TEMPLATES = [
diff --git a/app/costs/templates/costs/costs_all.html b/app/costs/templates/costs/costs_all.html
index 95cad67..cdd016e 100644
--- a/app/costs/templates/costs/costs_all.html
+++ b/app/costs/templates/costs/costs_all.html
@@ -18,7 +18,7 @@
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/responsive.bootstrap5.min.js"></script>
 
 <!-- Configure the DataTable. -->
-<script>
+<script nonce="{{request.csp_nonce}}">
     $(document).ready(function () {
         let table = $('#t__costs_all').DataTable({
             language: {
diff --git a/app/rescuer/templates/rescuer/rescuer_all.html b/app/rescuer/templates/rescuer/rescuer_all.html
index 2774741..047ea0d 100644
--- a/app/rescuer/templates/rescuer/rescuer_all.html
+++ b/app/rescuer/templates/rescuer/rescuer_all.html
@@ -14,7 +14,7 @@
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/dataTables.responsive.min.js"></script>
 <script src="https://cdn.datatables.net/responsive/2.2.9/js/responsive.bootstrap5.min.js"></script>
 
-<script>
+<script nonce="{{request.csp_nonce}}">
   $(document).ready(function () {
     let table = $('#t__rescuer_all').DataTable({
       language: {