filter_plugins/csp_filters.py

@@ -128,7 +128,7 @@ class FilterModule(object):
                 ):
                     domain = domains.get('portfolio')[0]
                     sld_tld = ".".join(domain.split(".")[-2:])  # yields "example.com"
-                    tokens.append(f"{sld_tld}")                 # yields "*.example.com"
+                    tokens.append(f"{sld_tld}")               # yields "*.example.com"
 
                 # whitelist
                 tokens += self.get_csp_whitelist(applications, application_id, directive)

roles/docker-espocrm/vars/configuration.yml

@@ -20,8 +20,6 @@ csp:
       unsafe-eval:    true
     style-src:
       unsafe-inline:  true
-    script-src:
-      unsafe-eval:    true
   whitelist:
     connect-src:
       - wss://espocrm.{{ primary_domain }}

roles/docker-matomo/vars/configuration.yml

@@ -13,14 +13,11 @@ csp:
     style-src:
       - https://fonts.googleapis.com
   flags:
-    script-src:
-      unsafe-eval:   true
     script-src-elem:
       unsafe-inline: true
       unsafe-eval:   true
     style-src:
       unsafe-inline: true
-      unsafe-eval:   true
 domains:
   aliases:
     - "analytics.{{ primary_domain }}"

roles/docker-openproject/vars/configuration.yml

@@ -8,7 +8,7 @@ ldap:
     users:            False   # Set true to filter users
 features:
   matomo:             true
-  css:                false   # Temporary deactivated. Needs to be optimized for production use.
+  css:                true
   portfolio_iframe:   false
   ldap:               true
   central_database:   true

roles/docker-peertube/vars/configuration.yml

@@ -9,8 +9,6 @@ csp:
   flags:
     script-src-elem:
       unsafe-inline:  true
-    script-src:
-      unsafe-inline:  true
     style-src:
       unsafe-inline:  true
   whitelist:

roles/docker-sphinx/vars/configuration.yml

@@ -4,8 +4,6 @@ features:
   portfolio_iframe:   false
 csp:
   flags:
-    script-src:
-      unsafe-eval:    true
     script-src-elem:
       unsafe-inline:  true
       unsafe-eval:    true

roles/nginx-modifier-matomo/tasks/main.yml

@@ -77,7 +77,7 @@
             (application_id): {
               'csp': {
                 'hashes': {
-                  'script-src-elem': (
+                  'script-src': (
                     applications[application_id]['csp']['hashes'].get('script-src', [])
                     + [ matomo_tracking_code_one_liner ]
                   )