diff --git a/django/contrib/admin/static/admin/css/forms.css b/django/contrib/admin/static/admin/css/forms.css index e28006cfa401..f24feba73750 100644 --- a/django/contrib/admin/static/admin/css/forms.css +++ b/django/contrib/admin/static/admin/css/forms.css @@ -1,5 +1,3 @@ -@import url("widgets.css"); - /* FORM ROWS */ .form-row { diff --git a/django/contrib/admin/templates/admin/auth/user/add_form.html b/django/contrib/admin/templates/admin/auth/user/add_form.html index f5a17dde7d47..96eecd3444b9 100644 --- a/django/contrib/admin/templates/admin/auth/user/add_form.html +++ b/django/contrib/admin/templates/admin/auth/user/add_form.html @@ -8,5 +8,5 @@ {% endblock %} {% block extrahead %} {{ block.super }} - + {% endblock %} diff --git a/django/contrib/admin/templates/admin/auth/user/change_password.html b/django/contrib/admin/templates/admin/auth/user/change_password.html index 70b68f6de588..e7f97ae97f7e 100644 --- a/django/contrib/admin/templates/admin/auth/user/change_password.html +++ b/django/contrib/admin/templates/admin/auth/user/change_password.html @@ -5,8 +5,9 @@ {% block title %}{% if form.errors %}{% translate "Error:" %} {% endif %}{{ block.super }}{% endblock %} {% block extrastyle %} {{ block.super }} - - + + + {% endblock %} {% block bodyclass %}{{ block.super }} {{ opts.app_label }}-{{ opts.model_name }} change-form{% endblock %} {% if not is_popup %} diff --git a/django/contrib/admin/templates/admin/base.html b/django/contrib/admin/templates/admin/base.html index 8ef92802a98f..b8330c02f55f 100644 --- a/django/contrib/admin/templates/admin/base.html +++ b/django/contrib/admin/templates/admin/base.html @@ -4,22 +4,22 @@ {% block title %}{% endblock %} - + {% block dark-mode-vars %} - - + + {% endblock %} {% if not is_popup and is_nav_sidebar_enabled %} - - + + {% endif %} {% block extrastyle %}{% endblock %} -{% if LANGUAGE_BIDI %}{% endif %} +{% if LANGUAGE_BIDI %}{% endif %} {% block extrahead %}{% endblock %} {% block responsive %} - - {% if LANGUAGE_BIDI %}{% endif %} + + {% if LANGUAGE_BIDI %}{% endif %} {% endblock %} {% block blockbots %}{% endblock %} diff --git a/django/contrib/admin/templates/admin/change_form.html b/django/contrib/admin/templates/admin/change_form.html index 39c883a7275e..f7dac55e0d9f 100644 --- a/django/contrib/admin/templates/admin/change_form.html +++ b/django/contrib/admin/templates/admin/change_form.html @@ -3,11 +3,15 @@ {% block title %}{% if errors %}{% translate "Error:" %} {% endif %}{{ block.super }}{% endblock %} {% block extrahead %}{{ block.super }} - -{{ media }} + +{% csp_nonce_attr media %} {% endblock %} -{% block extrastyle %}{{ block.super }}{% endblock %} +{% block extrastyle %} + {{ block.super }} + + +{% endblock %} {% block coltype %}colM{% endblock %} @@ -76,6 +80,7 @@ {% if adminform and add %} data-model-name="{{ opts.model_name }}" {% endif %} + {% csp_nonce_attr %} async> {% endblock %} diff --git a/django/contrib/admin/templates/admin/change_list.html b/django/contrib/admin/templates/admin/change_list.html index 4bb1b2f03be0..872a962740bc 100644 --- a/django/contrib/admin/templates/admin/change_list.html +++ b/django/contrib/admin/templates/admin/change_list.html @@ -4,16 +4,17 @@ {% block title %}{% if cl.formset and cl.formset.errors %}{% translate "Error:" %} {% endif %}{{ block.super }}{% endblock %} {% block extrastyle %} {{ block.super }} - + {% if cl.formset %} - + + {% endif %} {% if cl.formset or action_form %} - + {% endif %} - {{ media.css }} + {% csp_nonce_attr media.css %} {% if not actions_on_top and not actions_on_bottom %} - {% endif %} @@ -21,8 +22,8 @@ {% block extrahead %} {{ block.super }} -{{ media.js }} - +{% csp_nonce_attr media.js %} + {% endblock %} {% block bodyclass %}{{ block.super }} app-{{ opts.app_label }} model-{{ opts.model_name }} change-list{% endblock %} diff --git a/django/contrib/admin/templates/admin/delete_confirmation.html b/django/contrib/admin/templates/admin/delete_confirmation.html index 1c34a84d953a..7797f44eb394 100644 --- a/django/contrib/admin/templates/admin/delete_confirmation.html +++ b/django/contrib/admin/templates/admin/delete_confirmation.html @@ -3,8 +3,8 @@ {% block extrahead %} {{ block.super }} - {{ media }} - + {% csp_nonce_attr media %} + {% endblock %} {% block bodyclass %}{{ block.super }} app-{{ opts.app_label }} model-{{ opts.model_name }} delete-confirmation{% endblock %} diff --git a/django/contrib/admin/templates/admin/delete_selected_confirmation.html b/django/contrib/admin/templates/admin/delete_selected_confirmation.html index 40cfdbcc4cd2..cf503ec1230b 100644 --- a/django/contrib/admin/templates/admin/delete_selected_confirmation.html +++ b/django/contrib/admin/templates/admin/delete_selected_confirmation.html @@ -3,8 +3,8 @@ {% block extrahead %} {{ block.super }} - {{ media }} - + {% csp_nonce_attr media %} + {% endblock %} {% block bodyclass %}{{ block.super }} app-{{ opts.app_label }} model-{{ opts.model_name }} delete-confirmation delete-selected-confirmation{% endblock %} diff --git a/django/contrib/admin/templates/admin/index.html b/django/contrib/admin/templates/admin/index.html index 6f39d375ebab..f728fa88ffba 100644 --- a/django/contrib/admin/templates/admin/index.html +++ b/django/contrib/admin/templates/admin/index.html @@ -1,7 +1,7 @@ {% extends "admin/base_site.html" %} {% load i18n static admin_filters %} -{% block extrastyle %}{{ block.super }}{% endblock %} +{% block extrastyle %}{{ block.super }}{% endblock %} {% block coltype %}colMS{% endblock %} diff --git a/django/contrib/admin/templates/admin/login.html b/django/contrib/admin/templates/admin/login.html index fa0dcbc01db1..26af943968f8 100644 --- a/django/contrib/admin/templates/admin/login.html +++ b/django/contrib/admin/templates/admin/login.html @@ -2,8 +2,8 @@ {% load i18n static %} {% block title %}{% if form.errors %}{% translate "Error:" %} {% endif %}{{ block.super }}{% endblock %} -{% block extrastyle %}{{ block.super }} -{{ form.media }} +{% block extrastyle %}{{ block.super }} +{% csp_nonce_attr form.media %} {% endblock %} {% block bodyclass %}{{ block.super }} login{% endblock %} diff --git a/django/contrib/admin/templates/admin/popup_response.html b/django/contrib/admin/templates/admin/popup_response.html index 57a1ae36613d..eae9dcb07a0f 100644 --- a/django/contrib/admin/templates/admin/popup_response.html +++ b/django/contrib/admin/templates/admin/popup_response.html @@ -4,7 +4,8 @@ diff --git a/django/contrib/admin/templates/admin/prepopulated_fields_js.html b/django/contrib/admin/templates/admin/prepopulated_fields_js.html index dd6e56100d77..7080e23785ee 100644 --- a/django/contrib/admin/templates/admin/prepopulated_fields_js.html +++ b/django/contrib/admin/templates/admin/prepopulated_fields_js.html @@ -1,5 +1,6 @@ {% load static %} diff --git a/django/contrib/admin/templates/registration/password_change_form.html b/django/contrib/admin/templates/registration/password_change_form.html index 91c99c7fd135..aa1a21f20509 100644 --- a/django/contrib/admin/templates/registration/password_change_form.html +++ b/django/contrib/admin/templates/registration/password_change_form.html @@ -2,7 +2,11 @@ {% load i18n static %} {% block title %}{% if form.errors %}{% translate "Error:" %} {% endif %}{{ block.super }}{% endblock %} -{% block extrastyle %}{{ block.super }}{% endblock %} +{% block extrastyle %} + {{ block.super }} + + +{% endblock %} {% block userlinks %} {% url 'django-admindocs-docroot' as docsroot %}{% if docsroot %}{% translate 'Documentation' %} / {% endif %} {% translate 'Change password' %} /
diff --git a/django/contrib/admin/templates/registration/password_reset_confirm.html b/django/contrib/admin/templates/registration/password_reset_confirm.html index ffe51b59f83c..ff7fbb3ecba6 100644 --- a/django/contrib/admin/templates/registration/password_reset_confirm.html +++ b/django/contrib/admin/templates/registration/password_reset_confirm.html @@ -2,7 +2,11 @@ {% load i18n static %} {% block title %}{% if form.new_password1.errors or form.new_password2.errors %}{% translate "Error:" %} {% endif %}{{ block.super }}{% endblock %} -{% block extrastyle %}{{ block.super }}{% endblock %} +{% block extrastyle %} + {{ block.super }} + + +{% endblock %} {% block breadcrumbs %}
  1. {% translate 'Home' %}
    2. diff --git a/django/contrib/admin/templates/registration/password_reset_form.html b/django/contrib/admin/templates/registration/password_reset_form.html index 31c84fdcc70e..0ec1c039a96a 100644 --- a/django/contrib/admin/templates/registration/password_reset_form.html +++ b/django/contrib/admin/templates/registration/password_reset_form.html @@ -2,7 +2,11 @@ {% load i18n static %} {% block title %}{% if form.email.errors %}{% translate "Error:" %} {% endif %}{{ block.super }}{% endblock %} -{% block extrastyle %}{{ block.super }}{% endblock %} +{% block extrastyle %} + {{ block.super }} + + +{% endblock %} {% block breadcrumbs %}
    1. {% translate 'Home' %}
      2. diff --git a/django/contrib/admindocs/templates/admin_doc/model_detail.html b/django/contrib/admindocs/templates/admin_doc/model_detail.html index 6cf05d8f1b6a..0ae776a3415a 100644 --- a/django/contrib/admindocs/templates/admin_doc/model_detail.html +++ b/django/contrib/admindocs/templates/admin_doc/model_detail.html @@ -3,7 +3,7 @@ {% block extrahead %} {{ block.super }} - diff --git a/django/views/csrf.py b/django/views/csrf.py index adc629e843a9..55fd68c7032d 100644 --- a/django/views/csrf.py +++ b/django/views/csrf.py @@ -24,6 +24,7 @@ def csrf_failure(request, reason="", template_name=CSRF_FAILURE_TEMPLATE_NAME): Default view used when request fails CSRF protection """ from django.middleware.csrf import REASON_NO_CSRF_COOKIE, REASON_NO_REFERER + from django.template.context_processors import csp c = { "title": _("Forbidden"), @@ -64,7 +65,7 @@ def csrf_failure(request, reason="", template_name=CSRF_FAILURE_TEMPLATE_NAME): "DEBUG": settings.DEBUG, "docs_version": get_docs_version(), "more": _("More information is available with DEBUG=True."), - } + } | csp(request) try: t = loader.get_template(template_name) body = t.render(request=request) diff --git a/django/views/debug.py b/django/views/debug.py index f7e141d1c680..caa3d05cd8a2 100644 --- a/django/views/debug.py +++ b/django/views/debug.py @@ -673,6 +673,8 @@ def technical_404_response(request, exception): return HttpResponseNotFound(t.render(c)) +@csp_override({}) +@csp_report_only_override({}) def default_urlconf(request): """Create an empty URLconf 404 error response.""" with builtin_template_path("default_urlconf.html").open(encoding="utf-8") as fh: diff --git a/django/views/templates/csrf_403.html b/django/views/templates/csrf_403.html index 6a0daad5eed5..fc367cad04af 100644 --- a/django/views/templates/csrf_403.html +++ b/django/views/templates/csrf_403.html @@ -5,7 +5,7 @@ 403 Forbidden -