Diverse nonces im core eingesetzt (#5526)

Co-authored-by: Gregor Harlan <330436+gharlan@users.noreply.github.com>
redaxo · Jan 19, 2023 · 965786e · 965786e
1 parent dc9988a
commit 965786e
Show file tree

Hide file tree

Showing 36 changed files with 40 additions and 40 deletions.
diff --git a/redaxo/src/addons/backup/package.yml b/redaxo/src/addons/backup/package.yml
@@ -21,4 +21,4 @@ requires:
     php:
         version: '>=8.1'
         extensions: [ctype]
-    redaxo: ^5.9.0
+    redaxo: ^5.15.0-dev
diff --git a/redaxo/src/addons/backup/pages/export.php b/redaxo/src/addons/backup/pages/export.php
@@ -282,7 +282,7 @@
     ' . $content . '
 </form>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="' . rex_response::getNonce() . '">
     <!--
 
     (function($) {

diff --git a/redaxo/src/addons/cronjob/lib/form.php b/redaxo/src/addons/cronjob/lib/form.php
@@ -170,7 +170,7 @@ public function formatElement()
         $element = $fragment->parse('core/form/form.php');
 
         $element .= '
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
             // <![CDATA[
                 jQuery(function($){
                     $(".rex-js-cronjob-interval-all").each(function () {

diff --git a/redaxo/src/addons/cronjob/package.yml b/redaxo/src/addons/cronjob/package.yml
@@ -19,7 +19,7 @@ pages:
 
 requires:
     php: '>=8.1'
-    redaxo: ^5.13.0
+    redaxo: ^5.15.0-dev
 
 console_commands:
     cronjob:run: rex_command_cronjob_run
diff --git a/redaxo/src/addons/cronjob/pages/cronjobs.php b/redaxo/src/addons/cronjob/pages/cronjobs.php
@@ -341,7 +341,7 @@
 
     echo $content; ?>
 
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="<?= rex_response::getNonce() ?>">
     // <![CDATA[
         jQuery(function($){
             var currentShown = null;

diff --git a/redaxo/src/addons/install/package.yml b/redaxo/src/addons/install/package.yml
@@ -23,7 +23,7 @@ requires:
     php:
         version: '>=8.1'
         extensions: [zlib]
-    redaxo: ^5.13.0
+    redaxo: ^5.15.0-dev
 
 
 console_commands:

diff --git a/redaxo/src/addons/install/pages/packages.add.php b/redaxo/src/addons/install/pages/packages.add.php
@@ -176,7 +176,7 @@
     $content .= '</tbody></table>';
 
     $content .= '
-        <script type="text/javascript">
+        <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
         <!--
         jQuery(function($) {
             var table = $("#rex-js-table-install-packages-addons");

diff --git a/redaxo/src/addons/install/pages/packages.upload.php b/redaxo/src/addons/install/pages/packages.upload.php
@@ -125,7 +125,7 @@
 
         if (!$new) {
             echo '
-    <script type="text/javascript"><!--
+    <script type="text/javascript" nonce="' . rex_response::getNonce() . '"><!--
 
         jQuery(function($) {
             $("#rex-js-install-packages-upload-upload-file").change(function(){

diff --git a/redaxo/src/addons/media_manager/lib/effects/effect_image_properties.php b/redaxo/src/addons/media_manager/lib/effects/effect_image_properties.php
@@ -66,7 +66,7 @@ public function getParams()
                 'options' => [self::NO_INTERLACING, 'jpg', 'png', 'gif'],
                 'attributes' => ['multiple' => true, 'class' => 'selectpicker form-control'],
                 'suffix' => '
-<script type="text/javascript">
+<script type="text/javascript" nonce="' . rex_response::getNonce() . '">
     $(function() {
         var $field = $("#media-manager-rex-effect-image-properties-interlace-select");
 

diff --git a/redaxo/src/addons/media_manager/lib/effects/effect_mirror.php b/redaxo/src/addons/media_manager/lib/effects/effect_mirror.php
@@ -81,7 +81,7 @@ public function getParams()
                 'options' => ['colored', 'transparent / png24'],
                 'default' => 'colored',
                 'suffix' => '
-<script type="text/javascript">
+<script type="text/javascript" nonce="' . rex_response::getNonce() . '">
 <!--
 
 (function($) {

diff --git a/redaxo/src/addons/media_manager/lib/effects/effect_resize.php b/redaxo/src/addons/media_manager/lib/effects/effect_resize.php
@@ -141,7 +141,7 @@ public function getParams()
                 'options' => self::OPTIONS,
                 'default' => 'fit',
                 'suffix' => '
-<script type="text/javascript">
+<script type="text/javascript" nonce="' . rex_response::getNonce() . '">
 <!--
 
 $(function() {

diff --git a/redaxo/src/addons/media_manager/lib/effects/effect_workspace.php b/redaxo/src/addons/media_manager/lib/effects/effect_workspace.php
@@ -139,7 +139,7 @@ public function getParams()
                 'options' => ['colored', 'transparent'],
                 'default' => 'colored',
                 'suffix' => '
-<script type="text/javascript">
+<script type="text/javascript" nonce="' . rex_response::getNonce() . '">
 <!--
 
 $(function() {

diff --git a/redaxo/src/addons/media_manager/package.yml b/redaxo/src/addons/media_manager/package.yml
@@ -18,7 +18,7 @@ requires:
     php:
         version: '>=8.1'
         extensions: [gd]
-    redaxo: ^5.13.0
+    redaxo: ^5.15.0-dev
 
 default_config:
     jpg_quality: 80

diff --git a/redaxo/src/addons/media_manager/pages/effects.php b/redaxo/src/addons/media_manager/pages/effects.php
@@ -157,7 +157,7 @@
     $select->setSize(1);
 
     $script = '
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
     <!--
 
     (function($) {

diff --git a/redaxo/src/addons/media_manager/pages/settings.php b/redaxo/src/addons/media_manager/pages/settings.php
@@ -124,7 +124,7 @@
         </fieldset>
     </form>
 
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
     <!--
 
     (function($) {

diff --git a/redaxo/src/addons/mediapool/package.yml b/redaxo/src/addons/mediapool/package.yml
@@ -31,4 +31,4 @@ image_extensions: [bmp, gif, jpeg, jpg, png, svg, tif, tiff, webp]
 
 requires:
     php: '>=8.1'
-    redaxo: ^5.13.0
+    redaxo: ^5.15.0-dev
diff --git a/redaxo/src/addons/mediapool/pages/index.php b/redaxo/src/addons/mediapool/pages/index.php
@@ -93,7 +93,7 @@
 
 if (!rex_request::isXmlHttpRequest()) {
     ?>
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="<?= rex_response::getNonce() ?>">
         rex_retain_popup_event_handlers("rex:selectMedia");
         <?= $openerInputField ? 'rex.mediapoolOpenerInputField = "'.rex_escape($openerInputField, 'js').'";' : '' ?>
     </script>

diff --git a/redaxo/src/addons/mediapool/pages/sync.php b/redaxo/src/addons/mediapool/pages/sync.php
@@ -149,7 +149,7 @@
                 </fieldset>
             </form>
 
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
                 jQuery(document).ready(function($){
                     $("input[name=\'sync_files[]\']").change(function() {
                         $(this).closest(\'form\').find("[type=\'submit\']").attr("disabled", $("input[name=\'sync_files[]\']:checked").length == 0);

diff --git a/redaxo/src/addons/mediapool/pages/upload.php b/redaxo/src/addons/mediapool/pages/upload.php
@@ -42,7 +42,7 @@
                         }
                     }
 
-                    echo '<script type="text/javascript">';
+                    echo '<script type="text/javascript" nonce="' . rex_response::getNonce() . '">';
                     if (isset($js)) {
                         echo $js;
                     }

diff --git a/redaxo/src/addons/metainfo/lib/restrictions_element.php b/redaxo/src/addons/metainfo/lib/restrictions_element.php
@@ -50,7 +50,7 @@ public function get()
         $html = '';
 
         $html .= '
-        <script type="text/javascript">
+        <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
         <!--
 
         jQuery(function($) {

diff --git a/redaxo/src/addons/metainfo/lib/table_expander.php b/redaxo/src/addons/metainfo/lib/table_expander.php
@@ -100,7 +100,7 @@ public function init()
             }
         }
         $notices .= '
-        <script type="text/javascript">
+        <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
             var needle = new getObj("' . $field->getAttribute('id') . '");
             meta_checkConditionalFields(needle.obj, new Array(' . implode(',', $typeFields) . '), new Array(' . implode(',', $textFields) . '));
         </script>';

diff --git a/redaxo/src/addons/metainfo/package.yml b/redaxo/src/addons/metainfo/package.yml
@@ -16,7 +16,7 @@ page:
 
 requires:
     php: '>=8.1'
-    redaxo: '^5.13.0'
+    redaxo: ^5.15.0-dev
     packages:
         structure: '^2.12.1'
         mediapool: '^2.10.1'
diff --git a/redaxo/src/addons/structure/package.yml b/redaxo/src/addons/structure/package.yml
@@ -27,7 +27,7 @@ system_plugins: [content]
 
 requires:
     php: '>=8.1'
-    redaxo: ^5.13.0
+    redaxo: ^5.15.0-dev
 
 default_config:
     start_article_id: 1

diff --git a/redaxo/src/addons/structure/pages/linkmap.php b/redaxo/src/addons/structure/pages/linkmap.php
@@ -68,7 +68,7 @@
 }
 
 ?>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<?= rex_response::getNonce() ?>">
     <?php echo $retainEventHandlers ?>
 
     function insertLink(link,name){

diff --git a/redaxo/src/addons/structure/plugins/content/lib/article_content_editor.php b/redaxo/src/addons/structure/plugins/content/lib/article_content_editor.php
@@ -453,7 +453,7 @@ protected function addSlice($sliceId, $moduleId)
                     <form action="' . rex_url::currentBackendPage(['article_id' => $this->article_id, 'slice_id' => $sliceId, 'clang' => $this->clang, 'ctype' => $this->ctype]) . '#slice-add-pos-' . $this->sliceAddPosition . '" method="post" id="REX_FORM" enctype="multipart/form-data">
                         ' . $sliceContent . '
                     </form>
-                    <script type="text/javascript">
+                    <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
                          <!--
                         jQuery(function($) {
                             $(":input:visible:enabled:not([readonly]):first", $("#REX_FORM")).focus();
@@ -531,7 +531,7 @@ protected function editSlice($sliceId, $moduleInput, $ctypeId, $moduleId, $artDa
                 <form enctype="multipart/form-data" action="' . rex_url::currentBackendPage(['article_id' => $this->article_id, 'slice_id' => $sliceId, 'ctype' => $ctypeId, 'clang' => $this->clang, 'function' => 'edit']) . '#slice' . $sliceId . '" method="post" id="REX_FORM">
                     ' . $sliceContent . '
                 </form>
-                <script type="text/javascript">
+                <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
                      <!--
                     jQuery(function($) {
                         $(":input:visible:enabled:not([readonly]):first", $("#REX_FORM")).focus();

diff --git a/redaxo/src/addons/structure/plugins/content/package.yml b/redaxo/src/addons/structure/plugins/content/package.yml
@@ -35,7 +35,7 @@ pages:
             actions: { title: translate:actions }
 
 requires:
-    redaxo: ^5.13.0
+    redaxo: ^5.15.0-dev
 
 conflicts:
     packages:

diff --git a/redaxo/src/addons/structure/plugins/content/pages/modules.actions.php b/redaxo/src/addons/structure/plugins/content/pages/modules.actions.php
@@ -378,7 +378,7 @@
             ' . $csrfToken->getHiddenField() . '
             ' . $content . '
         </form>
-        <script type="text/javascript">
+        <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
         <!--
 
         jQuery(function($) {

diff --git a/redaxo/src/addons/structure/plugins/content/pages/templates.php b/redaxo/src/addons/structure/plugins/content/pages/templates.php
@@ -306,7 +306,7 @@
         }
 
         $ctypesOut .= '
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
             <!--
             jQuery(function($) {
         ';
@@ -486,7 +486,7 @@
                 ' . $content . '
             </form>
 
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
             <!--
             jQuery(function($) {
                 // store the currently selected tab in the hidden input#rex-js-form-template-tab

diff --git a/redaxo/src/addons/structure/plugins/history/package.yml b/redaxo/src/addons/structure/plugins/history/package.yml
@@ -17,7 +17,7 @@ pages:
         title: translate:history
 
 requires:
+    redaxo: ^5.15.0-dev
     packages:
         structure: '^2.2.0'
         structure/content: '^2.2.0'
-    redaxo: '^5.15.0-dev'
diff --git a/redaxo/src/addons/users/package.yml b/redaxo/src/addons/users/package.yml
@@ -18,4 +18,4 @@ page:
 
 requires:
     php: '>=8.1'
-    redaxo: ^5.14.0
+    redaxo: ^5.15.0-dev
diff --git a/redaxo/src/addons/users/pages/roles.php b/redaxo/src/addons/users/pages/roles.php
@@ -139,7 +139,7 @@
 
     if ($fieldIds) {
         $content .= '
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
             <!--
 
             jQuery(function($) {

diff --git a/redaxo/src/addons/users/pages/users.php b/redaxo/src/addons/users/pages/users.php
@@ -528,7 +528,7 @@
             ' . $content . '
         </form>
 
-        <script type="text/javascript">
+        <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
         <!--
         jQuery(function($) {
             $("#rex-js-user-admin").change(function() {

diff --git a/redaxo/src/core/fragments/core/top.php b/redaxo/src/core/fragments/core/top.php
@@ -24,7 +24,7 @@
         $colorScheme = rex_escape($user->getValue('theme'));
     }
     echo "\n" . '    <meta name="color-scheme" content="' . $colorScheme . '">';
-    echo "\n" . '    <style>:root { color-scheme: ' . $colorScheme . ' }</style>';
+    echo "\n" . '    <style nonce="' . rex_response::getNonce() . '">:root { color-scheme: ' . $colorScheme . ' }</style>';
 
     $assetDir = rex_path::assets();
 
@@ -41,7 +41,7 @@
         }
     }
     echo "\n";
-    echo "\n" . '    <script type="text/javascript">';
+    echo "\n" . '    <script type="text/javascript" nonce="' . rex_response::getNonce() . '">';
     echo "\n" . '    <!--';
     echo "\n" . '    var rex = '.$this->jsProperties.';';
     echo "\n" . '    //-->';
@@ -72,7 +72,7 @@
             $attributes[] = 'defer="defer"';
         }
 
-        echo "\n" . '    <script type="text/javascript" src="' . $file .'" '. implode(' ', $attributes) .'></script>';
+        echo "\n" . '    <script type="text/javascript" src="' . $file .'" '. implode(' ', $attributes) .' nonce="' . rex_response::getNonce() . '"></script>';
     }
 ?>
 

diff --git a/redaxo/src/core/pages/login.php b/redaxo/src/core/pages/login.php
@@ -113,7 +113,7 @@ function disableLogin() {
     ' . $content . '
     ' . rex_csrf_token::factory('backend_login')->getHiddenField() . '
 </form>
-<script type="text/javascript">
+<script type="text/javascript" nonce="' . rex_response::getNonce() . '">
      <!--
     jQuery(function($) {
         $("#rex-form-login")

diff --git a/redaxo/src/core/pages/packages.list.php b/redaxo/src/core/pages/packages.list.php
@@ -137,7 +137,7 @@
         </table>';
 
 $content .= '
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
     <!--
     jQuery(function($) {
         var table = $("#rex-js-table-available-packages-addons");

diff --git a/redaxo/src/core/pages/setup.step4.php b/redaxo/src/core/pages/setup.step4.php
@@ -196,7 +196,7 @@
 $content .= '</form>';
 
 $content .= '
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="' . rex_response::getNonce() . '">
                  <!--
                 jQuery(function($) {
                     var $container = $(".rex-js-setup-step-4");